CYIL vol. 9 (2018)

CYIL 9 ȍ2018Ȏ PROTOCOL MODERNISING THE CONVENTION FOR THE PROTECTION OF INDIVIDUALS… Member States. 36 It also takes account of the future accession of the EU to the Convention, notably with regard to international (transborder) transfers. The GDPR declares, with regard to the adequate level of protection, the following: “Apart from the international commitments the third country or international organisation has entered into, the Commission should take account of obligations arising from the third country’s or international organisation’s participation in multilateral or regional systems in particular in relation to the protection of personal data, as well as the implementation of such obligations. In particular, the third country’s accession to the Council of Europe Convention of 28 January 1981 for the Protection of Individuals with regard to the Automatic Processing of Personal Data and its Additional Protocol should be taken into account. The Commission should consult the Board when assessing the level of protection in third countries or international organisations.” 37 Conversely, the revised Convention now explicitly stipulates that an appropriate level of protection for the purpose of transborder flows of personal data to a non-Party “ can be secured by the law of that State or international organisation, including the applicable international treaties or agreements ”. 38 The term “law” used in Art. 14(3).a of the Convention should have the same meaning as in Art. 4(1) of the Convention, requiring the Parties to take the necessary measures “in its law”, and should also cover the EU law. 39 It is apparent that the Convention regime and the EU law framework are closely interlinked and the close interaction and positive influence of the two systems upon each other could be illustrated by numerous examples. One recent instance of such mutual awareness is the definition of “purely personal or household activities” in terms of scope of the Convention stipulated in its Art. 3(2). The Explanatory Report 40 namely refers to the CJEU judgment in case C-212/13 Ryneš , 41 where this very same concept was interpreted with regard to Art. 3(2) of Directive 95/46. 42 The CJEU held, in the case that concerned legitimacy and legality of camera surveillance for the protection of private property, as follows: 36 The Court of Justice of the EU (hereinafter as the “CJEU”) already held with regard to the previous Directive 95/46/EC (now repealed by the GDPR), which nevertheless required transposition by national laws, that “ the harmonisation of those national laws is not limited to minimal harmonisation but amounts to harmonisation which is generally complete ”, thus pointing in the direction of uniform application of high level of protection throughout the EU. See joined cases C-468/10 and C-469/10 Asociación Nacional de Establecimientos Financieros de Crédito (ASNEF) and Federación de Comercio Electrónico y Marketing Directo (FECEMD) v Administración del Estado , ECLI:EU:C:2011:777, para. 29. 37 GDPR, para. 105 of the Preamble (emphasis added). 38 Art. 14(3).a of the Convention. 39 “ The term “law of the Parties” denotes, according to the legal and constitutional system of the particular country, all enforceable rules, whether of statute law or case law. It must meet the qualitative requirements of accessibility and previsibility (or “foreseeability”). (…) In particular, it includes States’ constitutions and all written acts of legislative authorities (laws in the formal sense) as well as all regulatory measures (decrees, regulations, orders and administrative directives) based on such laws. It also covers international conventions applicable in domestic law, including EU law. ” Explanatory Report, para. 32, emphasis added. 40 Explanatory Report, para. 28. 41 Case C-212/13 Ryneš , ECLI:EU:C:2014:2428. 42 Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, OJ L 281, 23. 11. 1995, p. 31.

151