The Council of Europe's Chair and Data Protection Commissioner ('DPC'), Alessandra Pierucci and Jean-Philippe Walter respectively, issued, on 7 September 2020, a joint statement on the Court of Justice of the European Union's ('CJEU') judgment in Data Protection Commissioner v. Facebook Ireland Limited, Maximillian Schrems (C-311/18) ('the Schrems II Case'). In particular, the joint statement recalls that the CJEU stressed the importance, at the international level, of appropriate safeguards, enforceable rights, and effective legal remedies when personal data is being processed for the purposes of public security, defence, and state security. In addition, the joint statement outlines, in the aftermath of the judgment, that the amended Convention for the Protection of Individuals with Regard to Automatic Processing of Personal Data ('Convention 108+') represents a legally binding international agreement for the protection of privacy and personal data.

Moreover, the joint statement highlights that Recital 105 of the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR') makes explicit reference to the Convention 108 in the context of the adequacy regime, and that therefore being party to the Convention 108+ could in the future also facilitate the case-by-case assessment that companies are required to do in the context of Standard Contractual Clauses. Moreover, the joint statement notes, in relation to the specific issue of the processing of personal data for national security and defence purposes, that Article 11 of Convention 108+ contains a robust system of checks and balances.

You can read the press release here and the joint statement here.