The Council of Europe protocol amending Convention 108, creating the modernised Convention 108+, has opened for signature, with the United Kingdom among the first states to sign. Convention 108 remains the only legally binding international data protection treaty.
Key points
- Introduces an obligation to notify serious data breaches to supervisory authorities.
- Strengthens accountability, including data protection by design and impact assessments.
- Expands data subject rights, including rights relating to automated decision-making.
- Updates rules on transborder data flows.
- Enters into force once enough parties have ratified it.
Convention 108+ is open to countries worldwide and closely reflects GDPR principles, so it underpins adequacy discussions and data flows between the UK, the EU and third countries. It also points to converging global expectations on breach notification and accountability.
Source: Protocol amending Convention 108, CETS No. 223 (Council of Europe)
Need help understanding what this change means for your organisation? Get in touch for a pragmatic, no-obligation conversation.
