CYIL vol. 16 (2025)

JAN KUBICA to the European Convention on Human Rights and Fundamental Freedoms (ECHR) and its Article 8. Despite the fact that a failure to meet the obligations under the convention cannot be subject to a review of the European Court of Human Rights (ECtHR) on its own, it can nevertheless be reviewed indirectly, since failing to meet the obligations under the convention can simultaneously constitute a breach of the ECHR’s Article 8. 31 The Convention 108 (and its modernised version) itself can therefore be understood as a concrete expression or specification of Article 8. 32 While the Convention 108+ has not reached the required number of ratifications to enter into force, this development is expected to take place this or next year. 33 Unlike the GDPR and the EU data protection regime in general, the focus of the CoE is not dual, but solely on the promotion of human rights. 34 That said, it is a question of extent, rather than a binary difference, since the Convention 108 as well as the Convention 108+ are not indifferent to the economic reality (e.g. its Preamble explicitly mentions the goal of “ contributing to the free flow of information ”, which has an apparent economic aspect), and economic interests are at the same time a realisation of certain human rights. The importance of the Convention 108 stems from its global influence. While the GDPR has de facto influence, the conventions are explicitly opened for non-CoE states, and their impact is then explicit, legal. The original Convention 108 was drafted with the intention to allow accession of (at least) the USA, Canada, Japan, and Australia, but the Convention 108+ goes significantly further in this global ambition. 35 This allows for a further, global, proliferation of the European approach to data protection. Regarding the regulation of automated decision-making, the original wording of the Convention 108 (similarly to other international instruments, such as the OECD Privacy Guidelines or the APEC Privacy Framework) did not contain any explicit mention of a similar right. 36 However, in the years leading up to the finalization of the Convention 108+, the CoE began to address the issue in two soft-law documents that already referenced a similar right. 37 In the Convention 108+ itself, the right is set as the very first right of the individual in the list of rights under Article 9. As explained below, the prevailing interpretation, supported by the Explanatory Report, is that this stipulates an active right of the data subject while granting the option to authorise by a law certain processing, in which this right shall not apply (Article 9(2), and in general Article 11): the restrictions in Article 9(1)a do not apply 31 And this then, in turn, has an impact on the EU regulation as well. In this regard, the ECJ ruled that data processing in breach of Article 8 ECHR is also incapable of satisfying the requirements of the (then applicable) Directive 95/46. See point 91 in Österreichischer Rundfunk and Others [2023] European Court of Justice C-465/00, ECLI:EU:C:2003:294. 32 UKROW (n 19) 239. 33 The text was finalised in 2018 and while the “ complex international situation has slowed down internal national approval processes ”, it may still come into force this year (by achieving the necessary number of ratifications), according to GREENLEAF, Graham ‘The New Data Protection Convention 108+ and Its Importance for Asia’ (2024) 2. 34 BYGRAVE, Lee A. ‘The “Strasbourg Effect” on Data Protection in Light of the “Brussels Effect”: Logic, Mechanics and Prospects’ (2021) 40 Computer Law & Security Review 105460, 7. 35 Ibid 2. 36 KUNER, Christopher, BYGRAVE, Lee A. and DOCKSEY, Christopher (eds), The EU General Data Protection Regulation (GDPR): A Commentary (Oxford University Press 2019) 528. 37 In 2010, Recommendation on the Protection of Individuals with Regard to Automatic Processing of Personal Data in the Context of Profiling and then in 2017 Guidelines on the Protection of Individuals with Regard to the Processing of Personal Data in the World of Big Data.

218