The Ad hoc Committee on Data Protection (CAHDATA), dated May 3, 2016, issued a consolidated draft convention 108 (PDF) submitted. Open issues include the following:
- Definition of consent (Art. 5 No. 2): reservation of the EU for coordination with the GDPR.
- Purpose limitation and proportionality principles (Art. 5 No. 4 lit. b and e): reservation of the EU for coordination with the GDPR.
- Data requiring special protection (Art. 6 No. 1): EU reservation on coordination with the GDPR.
- Free of charge right to information (Art. 8 lit. b): The EU wishes to explicitly mention the principle of free of charge in the wording.
- Right to object (“right to be forgotten”; Art. 8 lit. d): EU reservation on coordination with the GDPR.
- Scope of the binding effect of the Convention (or right of the Member States to derogate from it; Art. 9 Nos. 1 and 2): reservations of the EU and the Member States.
- Cross-border data disclosure between member states that may only be limited or subject to authorization by harmonized provisions of a regional international organization (i.e., e.g., EU law; Art. 12(1)): reservation by Russia:
The provision limiting the obligations of a State Party in the sphere of transborder flows of personal data subject to appropriate rules of an international regional organization diffuses and weakens the legal regime of the Convention. Furthermore, such a provision de facto creates a “privileged” group of states with a lesser scope of obligations within the framework of the Convention. The Russian Federation therefore proposes to exclude this provision from the text of indent 1 Article 12 of the Convention (proposal to delete the last sentence of this paragraph, starting “Such a party may however […]”).
- Derogation from the provisions on cross-border data disclosure to ensure freedom of expression (Art. 12 para. 7): EU reservation on coordination with the GDPR and from criticism of the wording.