to some “soft” forms, such as awareness-raising, training, staff exchange.
the assistance of the diplomatic or consular agents of
their own country.
140. The catalogue of possible co-operation activities is not exhaustive. In the first place, supervisory
authorities shall provide each other with mutual assistance, especially by sharing any relevant and useful
information. This information could be of a two-fold
nature: “information and documentation on their law
and administrative practice relating to data protection” (which normally does not raise any issues, such
information could be exchanged freely and made
publicly available) as well as confidential information,
including personal data.
147. Paragraph 3 specifies that requests be as specific
as possible in order to expedite the procedure.
141. As far as personal data is concerned, such
data can be exchanged only if it is essential for the
co-operation, that is, if without its provision the
co-operation would be rendered ineffective, or if the
“data subject concerned has given explicit, specific,
free and informed consent”. In any case, the transfer
of personal data must comply with the provisions of
the Convention, and in particular Chapter II (see also
Article 20 providing for the grounds for refusal).
142. Further to the provision of relevant and useful
information, the goals of co-operation can be achieved
by co-ordinated investigations or interventions as
well as joint actions. For the applicable procedures,
supervisory authorities shall refer to the applicable
domestic legislation such as codes of administrative,
civil or criminal procedure, or supra or international
commitments by which their jurisdictions are bound,
for example, mutual legal assistance treaties, having
assessed their legal capacity to enter into a co-operation of that type.
143. Paragraph 3 refers to a network of supervisory
authorities, as a means to contribute to the rationalisation of the co-operation process and thus to
the efficiency of the protection of personal data. It
is important to note that the Convention refers to
“a network” in singular form. This does not prohibit
supervisory authorities originating from the Parties
to take part in other relevant networks.
Article 18 – Assistance to data subjects
144. Paragraph 1 ensures that data subjects, whether
in a Party to the Convention or in a third country
will be enabled to exercise their rights recognised in
Article 9 regardless of their place of residence or their
nationality.
145. According to paragraph 2, where the data subject resides in another Party he or she is given the
option to pursue his or her rights either directly in
the country where information relating to the data
subject concerned is processed, or indirectly, through
the intermediary of the designated authority.
146. Moreover, data subjects residing abroad may
also have the opportunity to pursue their rights with
Article 19 – Safeguards
148. This article ensures that supervisory authorities
shall be bound by the same obligation to observe
discretion and confidentiality towards data protection
authorities of other Parties and data subjects residing
abroad.
149. Assistance from a supervisory authority on behalf
of a data subject may only be given in response to a
request from this data subject. The authority must
have received a mandate from the data subject and
may not act autonomously in his or her name. This
provision is of fundamental importance for mutual
trust, on which mutual assistance is based.
Article 20 – Refusal of requests
150. This article states that Parties are bound to
comply with requests for co-operation and mutual
assistance. The grounds for refusal to comply are enumerated exhaustively.
151. The term “compliance” which is used in littera c.
should be understood in the broader sense as covering
not only the reply to the request, but also the action
preceding it. For example, a requested authority might
refuse action not only if transmission to the requesting authority of the information asked for might be
harmful for the rights and fundamental freedoms of
an individual, but also if the very fact of seeking the
information might prejudice his or her rights and
fundamental freedoms. Furthermore, a requested
authority may be required by applicable national
law to ensure that other public order interests are
protected (e.g. ensuring the confidentiality of a police
investigation). To this end a supervisory authority may
be obliged to omit certain information or documents
in its response to a request.
Article 21 – Costs and procedures
152. The provisions of this article are analogous to
those found in other international instruments.
153. With a view to not burdening the Convention
with a mass of implementing details, paragraph 3 of
this article provides that procedure, forms and language to be used can be agreed between the Parties
concerned. The text of this paragraph does not require
any formal procedures, but allows for administrative
arrangements, which may even be confined to specific
cases. Moreover, it is advisable that Parties leave to the
competent supervisory authorities the power to conclude such arrangements. The forms of co-operation
and assistance may also vary from case to case. It is
obvious that the transmission of a request for access to
Convention 108+ ► Page 31