Documents considered by the Committee on 12 September 2018 Contents

31Personal data and the Council of Europe Convention

Committee’s assessment

Legally and politically important

Committee’s decision

Cleared from scrutiny; further information requested; drawn to the attention of Digital, Culture, Media and Sport Committee, the Science and Technology Committee, the Joint Committee on Human Rights and the Exiting the EU Committee

Document details

Proposed Council Decisions authorising Member States to: (a) sign, in the interest of the EU, the Protocol amending the Council of Europe Convention for the Protection of Individuals with regard to the Automatic Processing of Personal Data (ETS. No 108) (the amending Protocol); (b) ratify, in the interest of the European Union, the amending Protocol.

Legal base

(a) Article 16 TFEU in conjunction with Article 218(5) TFEU; —; QMV; (b) Article 16 TFEU in conjunction with Article 218(6)(a)(v) TFEU; EP consent; QMV

Department

Digital, Culture, Media and Sport

Document Numbers

(a) (39867), 9765/18, COM(18) 449; (b) (39866), 9766/18, COM(18) 451

Summary and Committee’s conclusions

31.1The EU is not a member nor observer of the Council of Europe as neither status is open to non-States. The 28 EU Member States are members, but the EU has been able to accede to certain Council of Europe Treaties333 where these are open to international organisations.

31.2Convention 108 of the Council of Europe on the protection of individuals with regard to the automatic processing of personal data came into force in 1981. It was ratified by the UK in 1987. It required acceding States to incorporate data protection measures into national law. For many years, the Convention has been the leading international legal instrument on personal data protection. The 1995 EC Data Protection Directive (which the UK’s Data Protection Act 1998 transposed) took Convention 108 as its starting point.

31.3Work on negotiating a Protocol to amend and modernise the Convention started in 2010. The Commission put forward a negotiating mandate for consideration by EU Member States in 2013. The mandate gave the EU334 the ability to negotiate on behalf of all EU Member States in areas where it had competence. An Amending Protocol was adopted by the Council of Europe on 18 May 2018.335 The proposed Council Decisions will provide EU authorisation for the Member States to sign and ratify the Amending Protocol. The proposed Decision for ratification also requires the consent of the European Parliament.

31.4The Amending Protocol will therefore be an example of an EU-authorised agreement. These are entered into by the Member States on behalf of and under the instructions of the EU, because the agreement covers matters of exclusive EU competence but is only open to state parties. Article 124(1) of the EU’s draft Withdrawal Agreement of 19 March, which has been agreed by the UK336 states that during the transition/implementation period, the UK shall remain bound by obligations stemming from such EU authorised agreements.

31.5The Amending Protocol aims to strengthen data protection as a fundamental right in the Convention; to achieve a balance with other fundamental freedoms (freedom of expression); to address challenges to privacy resulting from the use of new technology; to promote consistency with other legal frameworks such as the General Data Protection Regulation (GDPR)337 and the Law Enforcement Directive338 and to enhance the Convention’s monitoring mechanisms. Changes would also enable international organisations to be parties.339 This means that once the Amending Protocol has entered into force after ratification by all existing parties,340 the EU could itself accede to the new amended Convention.

31.6In our last Report of 4 July, we asked the Minister for Digital and the Creative Industries (Margot James) to write to us to confirm our understanding then, informed by officials, that the proposed Council Decision on signing had been due to be considered at a Council of 26 June and if so, how the UK voted. We also asked her to clarify that the proposed Council Decision authorising Member States to ratify is being postponed until the Autumn to tie in with the necessary consent of the European Parliament being obtained, meaning that Member States are unlikely to be able to sign the Convention until then. We said that we would not take exception to any scrutiny override because of the Minister’s advance explanation and the fact that the Convention is aligned with the GDPR which already applies to the UK. But we asked the Minister to keep us informed of progress towards the adoption of the Council Decision for ratification and the eventual signing of the Convention by the UK. We also asked various questions about the nature of EU competence being exercised, how the provisions of the proposed Withdrawal Agreement might apply in the event of the EU acceding to the Convention during the transition/implementation period and continued alignment of the Convention and Parties to the Convention with EU data protection rules should the EU become an influential Party in its own right.

31.7In a letter of 25 July, the Minister now informs us that:

31.8It is clear from Article 45(c) of the General Data Protection Regulation that the UK acceding to the amended Convention would assist it in obtaining a data adequacy decision after either its exit from the EU or at the end of the planned transition/implementation period, whichever applies. In view of this and the response to our previous questions provided by the Minister in her letter, we are content to clear both Council Decisions from scrutiny to enable the Government to support the proposed Council Decision authorising Member States to ratify the amended Convention (document (b)). As we said before, we do not take issue with the previous scrutiny override. We also draw this chapter and documents to the attention of the Digital, Culture, Media and Sport Committee, the Science and Technology Committee, the Joint Committee on Human Rights and the Exiting the EU Committee.

31.9However, we ask the Minister to let us know when both the consent of the European Parliament has been given and the Council has adopted document (b). We draw to the Minister’s attention the chapter also in this week’s Report on “Trade deals and data flows between the EU and third countries”.343 Our decision to clear these documents is partly based on the expectation that the Minister will be giving full answers to the wider questions raised in that chapter about EU-UK data flows in the event of a negotiated or non-negotiated exit, particularly during the debate we have recommended.

Full details of the documents

(a) Proposal for a Council Decision authorising Member States to sign, in the interest of the EU, the Protocol amending the Council of Europe Convention for the Protection of Individuals with regard to the Automatic Processing of Personal Data (ETS. No 108): (39867), 9765/18, COM(18) 449; (b) Proposal for a Council Decision authorising Member States to ratify, in the interest of the European Union, the Protocol amending the Council of Europe Convention for the Protection of Individuals with regard to the Automatic Processing of Personal Data (ETS. No 108): (39866), 9766/18, COM(18) 451.

Previous Committee Report

Thirty-fourth Report HC 301–xxxiii (2017–19), chapter 3 (4 July 2018).


333 For a list of Council of Europe Treaties which the EU has either signed or ratified, see this Treaty List as of 20 June 2018.

334 With the Commission as negotiator.

335 See the announcement on the128th Session of the Committee of Ministers (Elsinore, Denmark, 17–18 May 2018) Council of Europe website. The final text of the Amending Protocol which revises Convention (CM/Inf (2018)15-final).

336 Subject to the condition that “nothing is agreed until everything is agreed”.

337 Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

338 Directive (EU) 2016/680 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA.

339 Article 27—Accession by non-member States or international organisations: “After the entry into force of this Convention, the Committee of Ministers of the Council of Europe may, after consulting the Parties to this Convention and obtaining their unanimous agreement, and in light of the opinion prepared by the Convention Committee in accordance with Article 23.e, invite any State not a member of the Council of Europe or an international organisation to accede to this Convention by a decision taken by the majority provided for in Article 20.d of the Statute of the Council of Europe and by the unanimous vote of the representatives of the Contracting States entitled to sit on the Committee of Ministers”.

340 Convention 108 is open to all countries in the world and currently has 51 States Parties, namely the 47 Council of Europe Member States plus Uruguay, Mauritius, Senegal and Tunisia (by order of accession, Tunisia becoming a Party on 1 November 2017). Argentina, Burkina Faso, Cape Verde and Morocco have also been invited to accede and Mexico has recently submitted an accession request.

341 She adds that this was as an A’ agenda point following prior approval of the point at Coreper on the 20th under the unanimity voting procedure in light of the common accord amongst all Member States to sign. At Coreper the UK had indicated its intention to support the proposal. Point ‘A’ agenda items are normally adopted without a vote or discussion at Council meetings

342 The Amending Protocol will enter into force under two options: (i) when all existing Parties (52 or more) have ratified it; or (ii) a partial entry into force in 5 years (2023) between the Parties who have entered into it, provided 38 Parties have ratified it. Implementation of new EU data protection package means 28 EU Member States can ratify now if they choose, following signature. Another 10 (including new ratifications) will be required by 2023.

343 See chapter 1 of this Report: 38493, 40020.




Published: 18 September 2018