The National Assembly ratified by law the Protocol amending the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention ETS No. 108) on the 11th of September 2019.
The Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, widely known as Convention 108, was adopted by the Council of Europe in 1981. The Convention is the first legally binding international act adopted in the field of personal data protection. Bulgaria ratified the Convention on the 18th of September 2002.
The modernisation of Convention 108 is a result of and responds to the privacy challenges raising due to the fast development of new information and communication technologies, plus the formation of a digital society. The modernised Convention will provide a stable and strong legal framework against data infringements which are one of the major problems modern society struggles with. The mechanism to ensure the effective implementation of the Convention is being strengthened.
The Protocol amending Convention 108 reflects the broad consensus over the amendment of the Convention in the following aspects: maintaining the general and technologically neutral nature of the provisions of the Convention; reaffirming its open character, which creates the unique potential to apply it as a universal standard for data protection. The provisions of the Protocol introduce the principle of proportionality of intervention, and the achievement of a fair balance between the public and private interests.
Special protection is provided for certain categories of personal data (genetic data; biometric data; personal data in regards to offences, prosecutions and convictions; as well as personal data revealing information about racial or ethnic origin, political views, trade union membership, religious or other beliefs, health status or sexual preferences).
The Protocol contains relevant innovations such as the obligation to notify about data security breaches, and the reinforcement of the proportionate lawfulness of processing and the principle of data minimisation. Increasing accountability of data controllers and the transparent processing of data are essential requirements to maintain trust in the digital environment. Enabling individuals to be informed, understand and control the processing of their personal data is a core concept of the transparency principle of data processing, established in Art. 10 of the Protocol amending Art. 8 of the Convention.
The Protocol will enter into force after it has been ratified by all Member States to Convention 108. The modernised Convention, as a one of a kind standard for personal data protection, will continue to be open to accession by any country in the world willing to implement it in their national legislation.
