Article 11 – Exceptions and restrictions
91. No exceptions to the provisions of Chapter II
are allowed except for a limited number of provisions (Article 5 paragraph 4, Article 7 paragraph 2,
Article 8 paragraph 1 and Article 9) on condition that
such exceptions are provided for by law, that they
respect the essence of the fundamental rights and
freedoms, and are necessary in a democratic society
for the grounds listed in litterae a. and b. of the first
paragraph of Article 11. A measure which is “necessary
in a democratic society” must pursue a legitimate aim
and thus meet a pressing social need which cannot
be achieved by less intrusive means. Such a measure
should, furthermore, be proportionate to the legitimate aim being pursued and the reasons adduced by
the national authorities to justify it should be relevant
and adequate. Such a measure must be prescribed
by an accessible and foreseeable law, which must be
sufficiently detailed.
92. All processing of personal data must be lawful,
fair and transparent in relation to the data subjects,
and only processed for specific purposes. This does not
in itself prevent the law enforcement authorities from
carrying out activities such as covert investigations or
video surveillance. Such activities can be done for the
purposes of the prevention, investigation, detection or
prosecution of criminal offences and the execution of
criminal penalties, including the safeguarding against
and the prevention of threats to national security and
public safety, as long as they are laid down by law and
constitute a necessary and proportionate measure in a
democratic society with due regard for the legitimate
interests of the data subjects.
93. The necessity of such exceptions needs to be
examined on a case-by-case basis and in light of the
essential objectives of general public interest, as is
detailed in litterae a. and b. of the first paragraph. Littera
a. lists some objectives of general public interest of
the State or of the international organisation which
may require exceptions.
94. The notion of “national security” should be interpreted on the basis of the relevant case law of the
European Court of Human Rights.13
95. The term “important economic and financial
interests” covers, in particular, tax collection requirements and exchange control. The term “prevention,
investigation and prosecution of criminal offences
and the execution of criminal penalties” in this littera
includes the prosecution of criminal offences and
13. The relevant case law includes in particular the protection
of state security and constitutional democracy from, inter
alia, espionage, terrorism, support for terrorism and separatism. Where national security is at stake, safeguards against
unfettered power must be provided. Relevant decisions of
the European Court of Human Rights can be found at the
Court’s website (hudoc.echr.coe.int).
Page 26 ► Convention 108+
the application of sanctions related thereto. The term
“other essential objectives of general public interest”
covers inter alia, the prevention, investigation, detection and prosecution of breaches of ethics for regulated
professions and the enforcement of civil law claims.
96. Littera b. concerns the rights and fundamental
freedoms of private parties, such as those of the data
subject himself or herself (for example when a data
subject’s vital interests are threatened because he or
she is missing) or of third parties, such as freedom of
expression, including freedom of journalistic, academic, artistic or literary expression, and the right
to receive and impart information, confidentiality of
correspondence and communications, or business
or commercial secrecy and other legally protected
secrets. This should apply in particular to processing
of personal data in the audio-visual field and in news
archives and press libraries. In order to take account of
the importance of the right to freedom of expression
in every democratic society, it is necessary to interpret
notions relating to that freedom, such as journalism,
broadly.
97. The second paragraph leaves open the possibility
of restricting the provisions set out in Articles 8 and
9 with regard to certain data processing carried out
for archiving purposes in the public interest, scientific
or historical research purposes, or statistical purposes
which pose no recognisable risk of infringement to the
rights and fundamental freedoms of data subjects. For
instance, this could be the case with the use of data
for statistical work, in the public and private fields
alike, in so far as this data is published in aggregate
form and provided that appropriate data protection
safeguards are in place (see paragraph 50).
98. The additional exceptions allowed to Article 4
paragraph 3, Article 14 paragraphs 5 and 6, and Article
15 paragraph 2, litterae a., b., c., and d., in respect of
processing activities for national security and defence
purposes are without prejudice to applicable requirements in relation to the independence and effectiveness of review and supervision mechanisms.14
Article 12 – Sanctions and remedies
99. In order for the Convention to guarantee an
effective level of data protection, the duties of the
controller and processor and the rights of data subjects should be reflected in the Parties’ legislation with
corresponding sanctions and remedies.
14. For Parties that are Council of Europe member States, such
requirements have been developed by the case law of the
European Court of Human Rights under Article 8 of the
ECHR (see in particular ECtHR, Roman Zakharov v. Russia
(Application No. 47143/06), 4 December 2015, paragraph 233;
Szabó and Vissy v. Hungary (Application No. 37138/14), 12
January 2016, paragraphs 75 et seq.).