others, by “prevailing legitimate interests, in particular
important public interests” to the extent these are
provided for by law and such transfers constitute a
necessary and proportionate measure in a democratic
society (littera c.). Personal data may thus be transferred
on grounds that are similar to those listed in Article 11,
paragraphs 1 and 3. In all cases, Parties remain free
under the Convention to restrict data transfers to
non-Parties, be it for the purpose of data protection
or for other reasons.
109. Paragraph 2 refers to transborder flows of personal data to a recipient that is not subject to the
jurisdiction of a Party. As for any personal data flowing outside national frontiers, an appropriate level
of protection is to be guaranteed. In cases where
the recipient is not a Party to the Convention, the
Convention establishes two mechanisms to ensure
that the level of data protection is indeed appropriate;
either by law, or by ad hoc or approved standardised
safeguards that are legally binding and enforceable,
as well as duly implemented.
110. Paragraphs 2 and 3 apply to all forms of appropriate protection, whether provided by law or by
standardised safeguards. The law must include the
relevant elements of data protection as set out in this
Convention. The level of protection should be assessed
for each transfer or category of transfers. Various elements of the transfer should be examined such as: the
type of data; the purposes and duration of processing
for which the data are transferred; the respect of the
rule of law by the country of final destination; the
general and sectoral legal rules applicable in the State
or organisation in question; and the professional and
security rules which apply there.
111. The content of the ad hoc or standardised safeguards must include the relevant elements of data
protection. Moreover, the contractual terms could be
such, for example, that the data subject is provided
with a contact person on the staff of the person responsible for the data transfers, whose responsibility it is to
ensure compliance with the substantive standards of
protection. The data subject would be free to contact
this person at any time and at no cost in relation to
the data processing or transfers and, where applicable,
obtain assistance in exercising his or her rights.
112. The assessment as to whether the level of protection is appropriate must take into account the
principles of the Convention, the extent to which they
are met in the recipient State or organisation – in so
far as they are relevant for the specific case of transfer – and how the data subject is able to defend his
or her interests where there is non-compliance. The
enforceability of data subjects’ rights and the provision of effective administrative and judicial redress
for the data subjects whose personal data are being
transferred should be taken into consideration in the
Page 28 ► Convention 108+
assessment. Similarly, the assessment can be made for
a whole State or organisation thereby permitting all
data transfers to such a destination.
113. Paragraph 4 enables Parties to derogate from the
principle of requiring an appropriate level of protection
and to allow a transfer to a recipient which does not
ensure such protection. Such derogations are permitted in limited situations only: with the data subject’s
consent or specific interest and/or where there are
prevailing legitimate interests provided by law and/
or the transfer constitutes a necessary and proportionate measure in a democratic society for freedom
of expression. Such derogations should respect the
principles of necessity and proportionality.
114. Paragraph 5 makes provision for a complementary safeguard: namely that the competent supervisory
authority be provided with all relevant information
concerning the transfers of data referred to in paragraphs 3.b, and, upon request 4.b and 4.c. The authority
should be entitled to request relevant information
about the circumstances and justification of these
transfers. Under the conditions laid down in Article
11, paragraph 3, exceptions to Article 14, paragraph
5 are permissible.
115. According to paragraph 6, the supervisory authority should be entitled to request that the effectiveness
of the measures taken or the existence of prevailing
legitimate interests be demonstrated, and to prohibit,
suspend or impose conditions on the transfer if this
proves necessary to protect the rights and fundamental freedoms of the data subjects. Under the conditions
laid down in Article 11, paragraph 3 exceptions to
Article 14, paragraph 6 are permissible.
116. Ever increasing data flows and the related need
to increase the protection of personal data also require
an increase in international enforcement co-operation
among competent supervisory authorities.
Chapter IV – Supervisory authorities16
Article 15 – Supervisory authorities
117. This article aims at ensuring the effective protection of individuals by requiring the Parties to provide
for one or more independent and impartial public
supervisory authorities that contribute to the protection of the individuals’ rights and freedoms with regard
to the processing of their personal data. Such authorities may be a single commissioner or a collegiate body.
In order for data protection supervisory authorities to
be able to provide for an appropriate remedy, they
need to have effective powers and functions and enjoy
16. From the entry into force of the Amending Protocol, the
Additional Protocol regarding supervisory authorities and
transborder flows (ETS No. 181) shall be considered an integral
part of the Convention as amended.