30 years on - The review of the council of Europe data protection convention 108

Computer Law and Security Review

Volumn 27, Issue 3, 2011, Pages 223-231

  Kierkegaard, Sylvia ^a   Waters, Nigel ^b   Greenleaf, Graham ^c   Bygrave, Lee A ^d   Lloyd, Ian ^a   Saxby, Steve ^a  

^a UNIVERSITY OF SOUTHAMPTON   (United Kingdom)

^b Law Faculty and Formerly Deputy Commonwealth Privacy Commissioner   (Australia)

^c Australasian Legal Information Institute (AustLII)   (Australia)

^d UNIVERSITY OF OSLO   (Norway)

Author keywords

Convention 108; Council of Europe data protection Convention; Data protection; IAITL; ILAWS; Transborder data flows

Indexed keywords

DATA PRIVACY; LAWS AND LEGISLATION;

CONVENTION 108; COUNCIL OF EUROPE; IAITL; ILAWS; TRANSBORDER DATA FLOW;

SECURITY OF DATA;

EID: 79958042032     PISSN: 02673649     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.clsr.2011.03.007     Document Type: Article

References (7)

1. This part of our submission is drawn from Lee A. Bygrave, Data Protection Law: Approaching Its Rationale, Logic and Limits (Kluwer Law International, 2002), chapter 19.
2. Cf. principle 5.9 of the ILO Code of Practice on Protection of Workers? Personal Data (1997) which stipulates: "Persons who process personal data should be regularly trained to ensure an understanding of the data collection process and their role in the application of the principles in this code".
3. This sort of rule is present in section 9a of Germany's Federal Data Protection Act of 1990 (as amended) ("Zur Verbesserung des Datenschutzes und der Datensicherheit können Anbieter von Datenverarbeitungssystemen und eprogrammen und Datenverarbeitende Stellen ihr Datenschutzkonzept sowie ihre technischen Einrichtungen durch unabhängige und zugelassene Gutachter prüfen und bewerten sowie das Ergebnis der Prüfung veröffentlichen lassen. Die näheren Anforderungen an die Prü- fung und Bewertung, das Verfahren sowie die Auswahl und Zulassung der Gutachter werden durch besonderes Gesetz geregelt").
4. See NPP 8 in Schedule 3 to Australia's federal Privacy Act ("Wherever it is lawful and practicable, individuals should have the option of not identifying themselves when entering transactions") and IPP 8 in Schedule 1 to the Information Privacy Act
5. of the Australian State of Victoria ("Wherever it is lawful and practicable, individuals must have the option of not identifying themselves when entering transactions with an organisation").
6. There is some trace of it also in recital 30 of the preamble to EU Directive 2002/58 ("Systems for the provision of electronic communications networks and services should be designed to limit the amount of personal data necessary to a strict minimum").
7. Cf. x 21 of the Norwegian Act. 2.