Today, Privacy Lives joins 12 civil liberty groups (including the ACLU, EPIC and Privacy Rights Clearinghouse) in sending a letter (pdf) to the US Senate urging the chamber to “request accession to the Council of Europe’s Convention 108 for the Protection of Individuals with regard to Automatic Processing of Personal Data.”
Founded in 1949, the Council of Europe “seeks to develop throughout Europe common and democratic principles.” The US is one of five observer countries; there are 47 member countries. The United States has signed onto other COE conventions, such as the 2001 Convention on Cybercrime, which was ratified by the Senate in 2006.
Convention 108 sets out a framework for protecting all data, especially focusing on data-sharing among countries. There are three main parts: (1) basic principles, which are substantive law provisions; (2) special rules on transborder data flows; and, (3) mechanisms for mutual assistance and consultation between the parties (countries).
The Convention covers data processing and collection by both government agencies and private sector companies. Its Articles are a floor for data protection laws, not a ceiling.
The Council of Europe recently decided to allow non-member countries to sign on to the Convention, and we are urging the Senate to take steps to do so. As part of this process, the US must create an independent data protection authority, because that is a requirement for states to be a party to Convention 108.