CYIL vol. 9 (2018)

EMIL RUFFER CYIL 9 ȍ2018Ȏ the Czech Republic since 2003 and as its director from 2008 to 2016. Subsequently, he has been posted to Strasbourg since April 2016 as the Permanent Representative of the Czech Republic to the Council of Europe. Introduction – the Convention and its background The Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Strasbourg, 28 January 1981, hereinafter as the “Convention”) 2 was the first binding international instrument to safeguard and protect rights of individuals against potential abuses related to the collection and processing of personal data. Moreover, it also provided a regulatory framework for the transborder flow of personal data. It should be mentioned at the very outset that the Convention is directly related to Art. 8 of the European Convention on Protection of Fundamental Rights and Freedoms (hereinafter as the “ECHR”), 3 which safeguards the protection of private and family life, which is reflected clearly in the Convention’s Preamble, 4 and was confirmed by the European Court of Human Rights (hereinafter as the “ECtHR”). 5 Moreover, in the specific context of the European Union (hereinafter as the “EU”), the same right to privacy is contained in Art. 8 of the Charter of Fundamental Rights of the European Union (hereinafter as the “EU Charter”). 6 The point of departure of the Convention, both with regard to Art. 8 ECHR (Right to respect for private and family life) and Art. 10 ECHR (Freedom of expression), is summarised as follows in its Explanatory Report: “The convention’s point of departure is that certain rights of the individual may have to be protected vis-à-vis the free flow of information regardless of frontiers, the latter principle being enshrined in international and European instruments on human rights (see Article 10, European Human Rights Convention; Article 19, International Covenant on Civil and Political Rights). Where the present convention imposes certain restrictions or conditions on the exercise of freedom of information, it does so only to the extent strictly justified for the protection of other individual rights and freedoms, in particular the right to respect for individual privacy (see Article 8, European Human Rights Convention).” 7 In addition to providing guarantees in relation to the collection and processing of personal data, the Convention prohibits the processing of special categories of “sensitive” data on race, politics, health, religion, sexual life, or criminal records of persons, in the absence of proper legal safeguards. The Convention also provides for the individual’s right to know that information is stored on him or her and, if necessary, to have it corrected. As regards the potential restrictions of rights, they are permissible solely if overriding interests (such as I. 4 The Preamble of the Convention states (3 rd indent, emphasis added): “ Considering that it is desirable to extend the safeguards for everyone’s rights and fundamental freedoms, and in particular the right to the respect for privacy , taking account of the increasing flow across frontiers of personal data undergoing automatic processing ”. 5 ECtHR held that “ the protection of personal data is of fundamental importance to a person’s enjoyment of his or her right to respect for private and family life as guaranteed by Article 8 ”. See the judgment in case MS v. Sweden , Application No. 20837/92, 1997, para. 41. 6 OJ C 326, 26.10.2012, p. 391. 7 Explanatory Report to the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, para. 19. 2 ETS (European Treaty Series) No. 108. 3 ETS No. 5.

144