Data Privacy Day 2025 !

28 January, which has become a worldwide day to raise awareness of personal data protection and privacy, is the date on which the Council of Europe's Convention 108 for the Protection of Individuals with regard to Automatic Processing of Personal Data was opened for signature.

This is an opportunity to highlight the role of the Council of Europe, of which Monaco is a member, in the protection of personal data and the supervision of artificial intelligence.

Although it receives less media coverage than the European Union's General Data Protection Regulation (GDPR) 2016/679 of 27 April 2016, Convention 108 is nonetheless its historical foundation, and in its modernised version (Convention 108+) remains essential from a universal perspective. Its scope extends beyond the European regional framework.

* * *

From Convention 108 to Convention 108+

Adopted on 28 January 1981, Convention 108 is the first and only legally binding international instrument in the field of personal data protection.

Convention 108 is open not only to member states of the Council of Europe such as Monaco, but to any country, giving it a truly universal scope. It has been ratified by Argentina, Morocco, Mauritius, Mexico, Senegal, Tunisia and Uruguay.

In response to technological developments and new challenges in data protection, the Council of Europe has initiated a process to modernise Convention 108. Convention 108+, which was opened for signature on 10 October 2018, strengthens the protection of personal data in response to the challenges posed by the use of new information and communication technologies, in line with the high standards of European Union legislation.

Ratification by Monaco

The Principality of Monaco, which has been a Party to Convention 108 and its Additional Protocol regarding supervisory authorities and transborder data flows since 24 December 2008, approved the ratification of Convention 108+ by Law no. 1.566 of 3 December 2024, the provisions of which are transcribed in Law no. 1.565 of 3 December 2024 on the protection of personal data, which carries out a comprehensive and structural reform of Monegasque legislation in this area.

Interaction between Convention 108+ and the GDPR

Convention 108 had a direct influence on Directive 95/46/EC, the forerunner of the GDPR, by laying the foundations for the fundamental principles that now structure European legal frameworks: lawfulness, proportionality, purpose of processing and protection of the rights of data subjects. Conversely, the drafters of the modernised Convention 108+ ensured that it was consistent with the standards developed in the GDPR.

Ratification of Convention 108+ is a criterion taken into account by the European Union in its adequacy decisions, which determine whether a third country offers a level of protection of personal data equivalent to that of its Member States and allow the transfer of personal data between the European Union and that third country without additional guarantees.

Convention 108+, which is an (international) treaty, is less detailed than the GDPR, which is a (regional) legislation, but shares the same principles (purpose, proportionality, relevance, limited retention period, security; rights of data subjects; protection of these rights by supervisory authorities; obligations of data controllers and processors, etc.).

For example, Argentina and Uruguay, which are not members of the Council of Europe, have signed up to Convention 108 and obtained an adequacy decision from the European Commission, as their legislation offers guarantees equivalent to those of the RGPD.

Monaco is also seeking an adequacy decision to facilitate transfers of personal data from the European Union.

Complementarity of the Convention 108+

Although the GDPR is often perceived as the reference standard for personal data protection, Convention 108+ plays a complementary role. It strengthens Europe's position in terms of personal data protection.

Convention 108+ offers unique coverage with its general scope as it applies to both the private and public sectors, and includes national security and defence processing (in the European Union, the GDPR must be combined with Directive 2016/680 of 27 April 2016 ‘Police-Justice’).

It promotes cooperation between national supervisory authorities beyond the European Union and the Council of Europe, and has a monitoring mechanism via a Convention Committee (evaluation and surveillance).

Convention 108+ is a more discreet pillar than the GDPR in the harmonisation of international standards for the protection of personal data, but no less fundamental.

Read more about the Convention 108+ scheme

* * *

It should also be noted that the European Convention for the Protection of Human Rights and Fundamental Freedoms of 4 November 1950 (ECHR), to which Monaco is a party, also contributes to the protection of personal data.

Although it does not contain any specific provisions on personal data, it does provide a framework for the processing of such data, mainly through the application by the European Court of Human Rights of the right to respect for private life (article 8).

* * *