Documents considered by the Committee on 4 July 2018 Contents

3Personal data and the Council of Europe Convention

Committee’s assessment

Legally and politically important

Committee’s decision

Not cleared from scrutiny; further information requested; drawn to the attention of the Digital, Culture, Media and Sport Committee, the Science and Technology Committee, the Joint Committee on Human Rights and the Exiting the EU Committee

Document details

(a) Proposal for a Council Decision authorising Member States to sign, in the interests of the EU, the Protocol amending the Council of Europe Convention for the Protection of Individuals with regard to the Automatic Processing of Personal Data (ETS. No 108) (“the Convention”); (b) Proposal for a Council Decision authorising Member States to ratify, in the interests of the EU, the Protocol amending the Convention

Legal base

(a) Article 16 TFEU in conjunction with Article 218(5) TFEU:—; QMV (b) Article 16 TFEU, in conjunction with Article 218(6)(a)(v) TFEU; EP consent; QMV

Department

Digital, Culture, Media and Sport

Document Numbers

(a) (39867), 9765/18, COM (18) 449; (b) (39866), 9766/18, COM (18) 451

Summary and Committee’s conclusions

3.1The EU is not a member nor observer of the Council of Europe as neither status is open to non-States. The 28 EU Member States are members but the EU has been able to accede to certain Council of Europe Treaties19 where these are open to international organisations.

3.2Convention 108 of the Council of Europe on the protection of individuals with regard to the automatic processing of personal data came into force in 1981. It was ratified by the UK in 1985. It required acceding States to incorporate data protection measures into national law. For many years, the Convention has been the leading international legal instrument on personal data protection. The 1995 EC Data Protection Directive (which the UK’s Data Protection Act 1998 transposed) took Convention 108 as its starting point.

3.3Work on negotiating a Protocol to amend and modernise the Convention started in 2010. The Commission put forward a negotiating mandate for consideration by EU Member States in 2013. The mandate gave the EU20 the ability to negotiate on behalf of all EU Member States in areas where it had competence. An Amending Protocol was adopted by the Council of Europe on 18 May 2018.21 The proposed Council Decisions will provide EU authorisation for the Member States to sign and ratify the Amending Protocol. The proposed Decision for ratification also requires the consent of the European Parliament.

3.4The Amending Protocol will therefore be an example of an EU-authorised agreement. These are entered into by the Member States on behalf of and under the instructions of the EU, because the agreement covers matters of exclusive EU competence but is only open to state parties. Article 124(1) of the EU’s draft Withdrawal Agreement of 19 March, which has been agreed by the UK22 states that during the transition/implementation period, the UK shall remain bound by obligations stemming from such EU authorised agreements.

3.5The Amending Protocol aims to strengthen data protection as a fundamental right in the Convention; to achieve a balance with other fundamental freedoms (freedom of expression); to address challenges to privacy resulting from the use of new technology; to promote consistency with other legal frameworks such as the General Data Protection Regulation (GDPR)23 and the Law Enforcement Directive24 and to enhance the Convention’s monitoring mechanisms. Changes would also enable international organisations to be parties.25 This means that once the Amending Protocol has entered into force after ratification by all existing parties,26 the EU could itself accede to the new amended Convention.

3.6The Minister for Digital and the Creative Industries (Margot James) has submitted both an Explanatory Memorandum (EM) and a letter, both dated 19 June.

3.7Her letter seeks to explain and apologise for short notice of the proposed Council Decisions. These were slated for agreement in the ECOFIN Council meeting of 22 June to enable Member States to sign the Amended Protocol once opened for signing on 25 June. The Minister further explains that negotiation of the Amending Protocol itself had been slow and it was not agreed before May. Due to the late publication of the proposed Council Decisions, the timeline leading up to the signing of the Amending Protocol is “quite short”. This was despite pressure from the UK and other Member States for earlier publication of the Council Decisions to allow more time for national and Parliamentary consideration. The UK supports the Amending Protocol and intends to become a signatory. Given the short notice she does not seek clearance or a scrutiny waiver but asks for the Committee’s understanding that circumstances have been beyond the Government’s control.

3.8In her EM, the Minister makes the following key points:

Competence

Policy Implications:

Brexit implications

3.9Given the short notice of the potential agreement of these proposed Council Decisions, we were unable to consider them in time for any clearance or scrutiny waiver before the Council meeting of 26 June (not the 22 June as the Minister expected) at which we understand the UK supported the proposed Decision authorising signature of the Convention.31 We further understand from officials that the European Parliament is not expected to give its consent to the proposed Council Decision authorising Member States to ratify the Amending Protocol until the Autumn.

3.10We therefore ask the Minister to write to us to:

3.11In the event that the Minister formally confirms that the UK did override scrutiny on 26 June in respect of the proposed Council Decision for signature, we are unlikely to take exception given the Minister’s advance explanation and the fact that the Convention is aligned with the GDPR which already applies to the UK. But we ask the Minister to keep us informed of progress towards the adoption of the Council Decision for ratification and the eventual signing of the Convention by the UK. We ask that any request for clearance or scrutiny waiver be made with plenty of notice.

3.12We also ask the Minister to respond to the following questions:

3.13In the meantime, we retain these documents under scrutiny. We draw this chapter and these documents to the attention of the Digital, Culture, Media and Sport Committee, the Science and Technology Committee, the Joint Committee on Human Rights and the Exiting the EU Committee.

Full details of the documents:

(a) Proposal for a Council Decision authorising Member States to sign, in the interest of the EU, the Protocol amending the Council of Europe Convention for the Protection of Individuals with regard to the Automatic Processing of Personal Data (ETS. No 108): (39867), 9765/18, COM(18) 449; (b) Proposal for a Council Decision authorising Member States to ratify, in the interest of the European Union, the Protocol amending the Council of Europe Convention for the Protection of Individuals with regard to the Automatic Processing of Personal Data (ETS.No.108): (39866), 9766/18, COM(18) 451.

Previous Committee Reports

None.


19 For a list of Council of Europe Treaties which the EU has either signed or ratified, see this Treaty List as of 20 June 2018.

20 With the Commission as negotiator.

21 See the announcement on the128th Session of the Committee of Ministers (Elsinore, Denmark, 17–18 May 2018) Council of Europe website. The final text of the Amending Protocol which revises Convention (CM/Inf (2018)15-final).

22 Subject to the condition that “nothing is agreed until everything is agreed”.

23 Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

24 Directive (EU) 2016/680 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA.

25 Article 27—Accession by non-member States or international organisations: “After the entry into force of this Convention, the Committee of Ministers of the Council of Europe may, after consulting the Parties to this Convention and obtaining their unanimous agreement, and in light of the opinion prepared by the Convention Committee in accordance with Article 23.e, invite any State not a member of the Council of Europe or an international organisation to accede to this Convention by a decision taken by the majority provided for in Article 20.d of the Statute of the Council of Europe and by the unanimous vote of the representatives of the Contracting States entitled to sit on the Committee of Ministers”.

26 Convention 108 is open to all countries in the world and currently has 51 States Parties, namely the 47 Council of Europe Member States plus Uruguay, Mauritius, Senegal and Tunisia (by order of accession, Tunisia becoming a Party on 1 November 2017). Argentina, Burkina Faso, Cape Verde and Morocco have also been invited to accede and Mexico has recently submitted an accession request.

27 See external competence based on Article 3(2) TFEU. As this competence, derived from extensive internal rules, is exclusive, the risk that the EU is exercising any “shared competence”(where either the EU or the Member State can act) is low.

28 A mixed agreement is where both the EU and Member States exercise competence.

29 See Section 183. The Data Protection Act 2018 implements the Law Enforcement Directive and makes changes to UK law to enable the UK to comply with the GDPR.

30 We assume the Minister means Article 45(2)(c) of the GDPR in conjunction with Recital 105, “the third country’s accession to the Council of Europe Convention of 28 January 1981 for the Protection of Individuals with regard to the Automatic Processing of Personal Data and its Additional Protocol should be taken into account”.

31 We note from the agenda that is it only the proposed Council Decision on signing that is due to be considered at the General Affairs Council of 26 June.

32 Article 3(1) of the Council Rules of Procedure provide: “The provisional agenda shall contain the items in respect of which a request for inclusion on the agenda, together with any documents relating thereto, has been received by the General Secretariat from a member of the Council or from the Commission at least 16 days before the beginning of that meeting”. Article 7 then provides “The agenda shall be adopted by the Council at the beginning of each meeting. The inclusion in the agenda of an item other than those appearing on the provisional agenda shall require unanimity in the Council”.

33 Article 3(7) of Rules of Procedure provides “The agenda shall be adopted by the Council at the beginning of each meeting. The inclusion in the agenda of an item other than those appearing on the provisional agenda shall require unanimity in the Council”.




Published: 10 July 2018