Europe in Strasbourg, 1981, sets the underpinnings to the European data protection
system, which grew steadily on its basic structure and preserves its core categorical
concepts. It is in force in 51 Parties, 47 of which are European.
5
Though the Convention was conceived in the pre-internet era, its substantive
structure is well adapted to the intense international transfer and processing of
personal data under an adequate protective structure. The Chapter II, on principles
of data protection, has a deep influence in all European law there-since.
At first, it establishes the duty of parties to “take the necessary measures in [their]
domestic law to give effect to the basic principles for data protection” (Article 4) and
undertake “to establish appropriate sanctions and remedies for violations” (Article
10). Though this report is not the best place to discuss these principles, a short
account may be useful because the European agreements on international trade and
economic cooperation rely on the structure provided for in the CE Convention 108.
The lawfulness, purposefulness and accuracy are the criteria for the quality of
data established in Article 5. These criteria require notably: (a) fair and lawful access
and processing, (b) no use that is incompatible with specified and relevant purposes,
(c) adequacy, relevance and no excess in relation to the purpose, (d) information that
accurate and updated, and (e) time limits “for no longer that is required for the
purpose”. It is important to stress that the purpose of the storage, transfer or
processing of data strictly determines how long, for which uses and which data can
be processed.
Sensitive data are subject to special concerns and limits. Article 6 forbids the
automatic processing, unless under appropriate safeguards provided by domestic
law, of information revealing, i.a., “racial origin, political opinions or religious or
other beliefs, (. . .) health or sexual life (. . .) [and] criminal convictions”.
Data security is provided for in Article 7, which states that “appropriate security
measures shall be taken (. . .) against accidental or unauthorised destruction, accidental loss as well as against unauthorised access, alteration or dissemination”.
Finally, any person is entitled to obtain information about and from the data
controller and obtain “rectification or erasure of such data” and “to have a remedy if
a request for confirmation or, as the case may be, communication, rectification or
erasure as referred (. . .) is not complied with”.
6.2 The European Economic Area
The European Economic Area (EEA) was constituted in 1994 and congregates the
EU and the EFTA areas in a single market. Switzerland is the only EFTA Member
that has not yet ratified the Agreement. The EFTA Members of the EEA agree to
5 Data in https://www.coe.int/en/web/conventions/full-list/-/conventions/treaty/108/signatures?p_
auth¼VteZzbU0, consulted in January 30, 2018.
486
J. A. F. Costa
system, which grew steadily on its basic structure and preserves its core categorical
concepts. It is in force in 51 Parties, 47 of which are European.
5
Though the Convention was conceived in the pre-internet era, its substantive
structure is well adapted to the intense international transfer and processing of
personal data under an adequate protective structure. The Chapter II, on principles
of data protection, has a deep influence in all European law there-since.
At first, it establishes the duty of parties to “take the necessary measures in [their]
domestic law to give effect to the basic principles for data protection” (Article 4) and
undertake “to establish appropriate sanctions and remedies for violations” (Article
10). Though this report is not the best place to discuss these principles, a short
account may be useful because the European agreements on international trade and
economic cooperation rely on the structure provided for in the CE Convention 108.
The lawfulness, purposefulness and accuracy are the criteria for the quality of
data established in Article 5. These criteria require notably: (a) fair and lawful access
and processing, (b) no use that is incompatible with specified and relevant purposes,
(c) adequacy, relevance and no excess in relation to the purpose, (d) information that
accurate and updated, and (e) time limits “for no longer that is required for the
purpose”. It is important to stress that the purpose of the storage, transfer or
processing of data strictly determines how long, for which uses and which data can
be processed.
Sensitive data are subject to special concerns and limits. Article 6 forbids the
automatic processing, unless under appropriate safeguards provided by domestic
law, of information revealing, i.a., “racial origin, political opinions or religious or
other beliefs, (. . .) health or sexual life (. . .) [and] criminal convictions”.
Data security is provided for in Article 7, which states that “appropriate security
measures shall be taken (. . .) against accidental or unauthorised destruction, accidental loss as well as against unauthorised access, alteration or dissemination”.
Finally, any person is entitled to obtain information about and from the data
controller and obtain “rectification or erasure of such data” and “to have a remedy if
a request for confirmation or, as the case may be, communication, rectification or
erasure as referred (. . .) is not complied with”.
6.2 The European Economic Area
The European Economic Area (EEA) was constituted in 1994 and congregates the
EU and the EFTA areas in a single market. Switzerland is the only EFTA Member
that has not yet ratified the Agreement. The EFTA Members of the EEA agree to
5 Data in https://www.coe.int/en/web/conventions/full-list/-/conventions/treaty/108/signatures?p_
auth¼VteZzbU0, consulted in January 30, 2018.
486
J. A. F. Costa