On the 8th July 2021, Italy ratified the protocol amending the Convention on the Protection of Individuals with regard to the Processing of Personal Data (Convention 108+) signed on 5th March 2019. It is, to date, the only internationally binding data protection instrument.
With the ratification by Italy of the protocol amending the 108+ Convention, an additional, important step forward towards the full implementation of the modernized 108+ Convention has been achieved.
As known on 10 October 2018 in Strasbourg has been formulated the Treaty No. 223 named Protocol amending the Convention on the Protection of Individuals with regard to Automatic Processing of Personal Data.
This is a legal framework that aims to modernise and improve Convention 108 by facilitating the cross-border flow of data between different parts of the world and various regulations, including the new EU Regulation, fully applicable from 25 May 2018, which refers to Convention 108 in the context of cross-border data flow (see recital 105).
Important developments in the Protocol include:
– Stricter requirements on the principles of proportionality and data minimisation and the lawfulness of data processing;
– Broadly from the categories of data known as “sensitive” which now include biometric and genetic data, indicators of union membership and ethnicity;
– Obligation to report data breach
– Greater transparency in data processing
– New rights of individuals to decision-making procedures based on algorithms, which assume particular relevance in the field of the development of artificial intelligence
– Strengthening the accountability of data controllers
– Obligation to apply the principle of “protection of privacy up to the implementation stage”
– Application of data protection principles to all data processing activities, including those carried out for reasons of national security protection, with possible exceptions and restrictions, except under the conditions set out in the Convention, in each case by ensuring effective and independent monitoring and supervision.
– Institution of a clear system of rules to discipline cross-border flows
– Strengthening the powers and independence of the authorities responsible for data protection and the legal bases necessary for international cooperation.
As our Authority notes: “the adoption of the Protocol marks the completion of the process of modernization of Convention 108, which, to date, is the only internationally binding data protection instrument.
The modernized Convention, also called “Convention 108+”, responds to the many challenges dictated by the development of new technologies and globalization, ensures the observance of the principles of the Convention and reinforces the effective implementation mechanisms.
Like the original Convention, the Protocol guarantees high standards of data protection with a flexible regulatory framework, which facilitates the adoption by a large number of countries, including those which are not part of the Council of Europe and to which the Protocol is open. It is also an important point of connection between the different regional approaches, including European Regulation 2016/679, which places the accession of third countries to the Convention 108 among criteria to be considered in the assessment of the adequacy of these countries in the context of extra-European data transfers (Recital 105).
Many of the developments included in the new Convention: on the part of a strengthening of the obligations of the controller including the principle of accuntability, greater transparency in treatments, preventive assessment of treatment risks, the privacy principles by default and by default, the notification of data breaches. On the other hand, the broad rights of data subjects, including the right not to be subject to purely automated decisions and to know the logic of the processing.
In addition, the Protocol reinforces the roles of the data protection authorities and the Convention Committee, which should play a specific role in the process of assessing effective compliance with the principles of the Convention, The Committee on Legal Affairs and Citizens’ Rights, Justice and Home Affairs, Justice and Home Affairs, Justice and Home Affairs, as well as the Committee on the Environment, Public Health and Consumer Protection. (Source: www.garanteprivacy.it [doc. web no 9088792] of 06.03.2019.
With the signature of ratification by Italy, States that have ratified the Protocol of Amendment may enter into force in the event of ratification by all existing States that are party to Convention No 108 (now 55), or even if within 5 years of the opening (and therefore before October 11, 2023) to the signature of the Protocol the ratification of at least 38 States is reached.
SOURCE: FEDERPRIVACY