Additional Protocol to the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data regarding Supervisory Authorities and Transborder Data Flows
Done at: Strasbourg
Date enacted: 2001-11-08
In force: 2004-07-01
Preamble
The Parties to this additional Protocol to the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, opened for signature in Strasbourg on 28 January 1981 (hereafter referred to as "the Convention");
Convinced that supervisory authorities, exercising their functions in complete independence, are an element of the effective protection of individuals with regard to the processing of personal data;
Considering the importance of the flow of information between peoples;
Considering that, with the increase in exchanges of personal data across national borders, it is necessary to ensure the effective protection of human rights and fundamental freedoms, and in particular the right to privacy, in relation to such exchanges of personal data,
Have agreed as follows:
Article 1
Supervisory authorities
1. |
Each Party shall provide for one or more authorities to be responsible for ensuring compliance with the measures in its domestic law giving effect to the principles stated in Chapters II and III of the Convention and in this Protocol. |
||||
2. |
|
||||
3. |
The supervisory authorities shall exercise their functions in complete independence. |
||||
4. |
Decisions of the supervisory authorities, which give rise to complaints, may be appealed against through the courts. |
||||
5. |
In accordance with the provisions of Chapter IV, and without prejudice to the provisions of Article 13 of the Convention, the supervisory authorities shall co-operate with one another to the extent necessary for the performance of their duties, in particular by exchanging all useful information. |
Article 2
Transborder flows of personal data to a recipient which is not subject to the jurisdiction of a Party to the Convention
1. |
Each Party shall provide for the transfer of personal data to a recipient that is subject to the jurisdiction of a State or organisation that is not Party to the Convention only if that State or organisation ensures an adequate level of protection for the intended data transfer. |
||||||||
2. |
By way of derogation from paragraph 1 of Article 2 of this Protocol, each Party may allow for the transfer of personal data:
|
Article 3
Final provisions
1. |
The provisions of Articles 1 and 2 of this Protocol shall be regarded by the Parties as additional articles to the Convention and all the provisions of the Convention shall apply accordingly. |
||||||||
2. |
This Protocol shall be open for signature by States Signatories to the Convention. After acceding to the Convention under the conditions provided by it, the European Communities may sign this Protocol. This Protocol is subject to ratification, acceptance or approval. A Signatory to this Protocol may not ratify, accept or approve it unless it has previously or simultaneously ratified, accepted or approved the Convention or has acceded to it. Instruments of ratification, acceptance or approval of this Protocol shall be deposited with the Secretary General of the Council of Europe. |
||||||||
3. |
|
||||||||
4. |
|
||||||||
5. |
|
||||||||
6. |
The Secretary General of the Council of Europe shall notify the member States of the Council of Europe, the European Communities and any other State which has acceded to this Protocol of:
|
In witness whereof the undersigned, being duly authorised thereto, have signed this Protocol.
Done at Strasbourg, this 8th day of November 2001, in English and in French, both texts being equally authentic, in a single copy which shall be deposited in the archives of the Council of Europe. The Secretary General of the Council of Europe shall transmit certified copies to each member State of the Council of Europe, the European Communities and any State invited to accede to the Convention.
Ratifications as of May 2016
Number of ratifications: 36
Albania, Andorra, Armenia, Austria, Bosnia and Herzegovina, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Georgia, Germany, Hungary, Ireland, Latvia, Liechtenstein, Lithuania, Luxembourg, Macedonia, Moldova, Monaco, Montenegro, Netherlands, Poland, Portugal, Romania, Serbia, Slovakia, Spain, Sweden, Switzerland, Ukraine, Uruguay