On September 7, 2023, the Council of Europe (CoE) announced that the President of the Swiss Confederation had transmitted the instrument of ratification of the Protocol of Amendment to the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108+). In particular, the aim of Convention 108+ is to modernize and improve Convention 108, taking into account the new challenges with regard to the processing of personal data through automatic means.

Among the features of Convention 108+ are:

• strengthening requirements relating to the principles of proportionality, data minimization, and lawfulness of processing;
• the expansion of the catalog of sensitive data, which would now include genetic and biometric data, and those relating to union membership and ethnic origin;
• obligation to notify data breaches;
• greater transparency regarding data processing;
• new rights granted to people in the context of decision-making based on algorithms, particularly important in the context of the development of artificial intelligence (AI);
• mandatory application of the principle of Privacy by Design;
• the application of data protection principles to all processing, including processing carried out for reasons of national security (with possible exceptions and restrictions subject to the conditions set out in Convention 108+), and in all cases subject to independent and effective control and supervision;
• establishment of a clear regime for cross-border data flows; and
• strengthening the powers and independence of data protection authorities, as well as the legal bases necessary for international cooperation.

You can read the press release here and access Convention 108+ here.