On 10 October 2018, ‘Convention 108’ of the Council of Europe regarding the ‘automatic processing of personal data’ (1985) was updated. Convention 108+ now explicitly incorporates the processing of personal data in a national securitycontext. The Netherlands signed Convention 108+ on 10 October 2018 and is now in the ratification process.

Surprisingly, Convention 108+ did not gain much attention yet. For the Netherlands, the treaty may bring changes to current legislation, because it provides more stringent regulations for the processing of data in a national security context and possibly provides for broader powers for oversight authorities.

Processing data in a national security context within the EU
Convention 108+ contains basic principles and provisions for processing personal data, as well as standards regarding oversight mechanisms and the international transfer of data. Many provisions are similar to the General Data Protection Regulation (GDPR).

However, the GDPR does not apply to national security and intelligence agencies. The European Union (EU) has no competence to regulate national security law for EU Member States. As a result, regulations for processing data in a national security context differ across the EU.

Convention 108+ may bring more harmonisation of the regulations for processing personal data and oversight mechanisms. The treaty enters into force on 11 October 2023 if there are 38 Parties to the Protocol amending Convention 108. So far, 36 States have signed the new Convention but only six have ratified.

Stricter regulations for processing data
Convention 108+ encompasses many basic principles of data processing, such as the principle of processing data (a) for specified and legitimate purposes; (b) adequate, relevant and not excessive in relation to the purposes for which they are stored; (c) accurate and, where necessary, kept up to date; and (d) no longer stored than necessary (see article 5 of Convention 108+). In addition, categories of sensitive data are identified (and updated in the new protocol) and data subjects gain certain rights (such as the right to be informed and the right to request rectification when informed).

In a national security context (similar to a law enforcement context) some principles do not apply or apply differently, such as the right to be informed of data processing and limitations to the notification principle. It is understandable, that some limitations to the notification principle apply. For instance, when so-called ‘targets’ (in a national security context) or ‘suspects’ (in a law enforcement context) are informed about the processing of their data, they know they are of interest to these national authorities and may then change their behaviour to continue their harmful activities without being detected.

The updated Convention 108+ strengthens the data processing regulations in a national security context. For example, the new Convention does not differentiate levels of protection afforded to a State’s own citizens or foreigners with regard to transborder flows of personal data (adjusted in article 14 of Convention 108+). Some States do apply this differentiation in their national security legislation. In addition, compared to Dutch legislation for national security and intelligence services, the Convention entails a broader definition of ‘sensitive data’, for which stricter regulations apply to process this type of data.

Oversight powers
Convention 108+ may bolster supervision of data processing activities in a national security context. Some oversight bodies for national security and intelligence agencies have access to data located at these agencies and some can even halt unlawful data processing activities. Convention 108+ demands that oversight bodies for data processing activities are independent (similar to the judiciary or a judicial body) and effective. Based on article 15 and 16 of the Convention, to be effective an oversight body must have the power to intervene, such as the possibility to halt data processing activities or even order that unlawfully processed data be deleted.

The new Convention allows for limitations to these far reaching powers in the field of national security and defense, provided that it is done ‘by law and only to the extent that it constitutes a necessary and proportionate measure in a democratic society to fulfill such an aim’. Granting oversight bodies such far reaching powers is a big step, because the fear of States may be that their security and intelligence services will no longer have pieces of information that may be relevant in the future to secure national security (for example to prevent a terrorist attack). However, from the perspective of protecting human rights, it can be argued that this step is part of the requirement of effective review and supervision of intelligence and security services, as interpreted in the jurisprudence of the European Court of Human Rights (ECHR) and pursued by the new Convention 108+.

Now what?
What does this mean for processing personal data for the purpose of national security? For the Netherlands, it means the provisions of Convention 108+ must be implemented in national law. This requires some changes, for example with regard to the aforementioned category of ‘sensitive data’. In addition, the Dutch oversight body for intelligence and security services does not have the binding power to intervene in unlawful data processing activities. The Dutch government must address this issue and decide which changes to law are desirable.

We welcome Convention 108+ because it brings more harmonisation to the regulations for processing data in a national security context and may strengthen oversight bodies for national security and intelligence agencies for States that ratify Convention 108+. It protects the individuals involved in the processing of personal data and provides more legal certainty with regard to the applicable rights and regulations. We look forward to contributing and monitoring the implementation of the treaty throughout the world.

Jan-Jaap Oerlemans & Mireille Hagens

This is cross post from the Montaigne Centre Blog.