ETS 108 – Automatic Processing of Personal Data, 28.I.1981
__________________________________________________________________________________
d

"controller of the file" means the natural or legal person, public authority, agency or any
other body who is competent according to the national law to decide what should be the
purpose of the automated data file, which categories of personal data should be stored
and which operations should be applied to them.

Article 3 – Scope
1

The Parties undertake to apply this Convention to automated personal data files and
automatic processing of personal data in the public and private sectors.

2

Any State may, at the time of signature or when depositing its instrument of ratification,
acceptance, approval or accession, or at any later time, give notice by a declaration
addressed to the Secretary General of the Council of Europe:
a

that it will not apply this Convention to certain categories of automated personal data
files, a list of which will be deposited. In this list it shall not include, however, categories
of automated data files subject under its domestic law to data protection provisions.
Consequently, it shall amend this list by a new declaration whenever additional
categories of automated personal data files are subjected to data protection provisions
under its domestic law;

b

that it will also apply this Convention to information relating to groups of persons,
associations, foundations, companies, corporations and any other bodies consisting
directly or indirectly of individuals, whether or not such bodies possess legal personality;

c

that it will also apply this Convention to personal data files which are not processed
automatically.

3

Any State which has extended the scope of this Convention by any of the declarations
provided for in sub-paragraph 2.b or c above may give notice in the said declaration that such
extensions shall apply only to certain categories of personal data files, a list of which will be
deposited.

4

Any Party which has excluded certain categories of automated personal data files by a
declaration provided for in sub-paragraph 2.a above may not claim the application of this
Convention to such categories by a Party which has not excluded them.

5

Likewise, a Party which has not made one or other of the extensions provided for in subparagraphs 2.b and c above may not claim the application of this Convention on these points
with respect to a Party which has made such extensions.

6

The declarations provided for in paragraph 2 above shall take effect from the moment of the
entry into force of the Convention with regard to the State which has made them if they have
been made at the time of signature or deposit of its instrument of ratification, acceptance,
approval or accession, or three months after their receipt by the Secretary General of the
Council of Europe if they have been made at any later time. These declarations may be
withdrawn, in whole or in part, by a notification addressed to the Secretary General of the
Council of Europe. Such withdrawals shall take effect three months after the date of receipt of
such notification.

Chapter II – Basic principles for data protection
Article 4 – Duties of the Parties
1

Each Party shall take the necessary measures in its domestic law to give effect to the basic
principles for data protection set out in this chapter.

2

Select target paragraph3