Key Benefits:
President of the Republic,
On the report of the Prime Minister and the Minister for Foreign and European Affairs,
Considering articles 52 to 55 of the Constitution;
Having regard to Act No. 2007-301 of 5 March 2007 authorizing the approval of the additional protocol to the Convention for the Protection of Persons with respect to the automated processing of personal data concerning the control authorities and transboundary data flows, done at Strasbourg on 8 November 2001;
Having regard to Decree No. 85-1203 of 15 November 1985 on the publication of the Convention for the Protection of Persons with regard to the automated processing of personal data, made in Strasbourg on 28 January 1981;
In view of the amended Decree No. 53-192 of 14 March 1953 concerning the ratification and publication of the international commitments undertaken by France,
Decrete:
The additional protocol to the Convention for the Protection of Persons with regard to the automated processing of personal data concerning the control authorities and transboundary data flows, done in Strasbourg on 8 November 2001, will be published in the Official Journal of the French Republic.
The Prime Minister and the Minister for Foreign and European Affairs are responsible for the execution of this decree, which will be published in the Official Journal of the French Republic.
ADDITIONAL PROTOCOL TO THE CONVENTION ON THE PROTECTION of PERSONAL PROTECTION OF THE AUTOMATIZED TRACKING OF PERSONAL DATA CONTROL AUTHORITY AND TRANSBOUNDARY FLUXES OF DATA
PREAMBULE
The Parties to this Protocol to the Convention for the Protection of Persons with regard to the automated processing of personal data, open for signature at Strasbourg on 28 January 1981 (hereinafter referred to as "the Convention"),
Convinced that independent supervisory authorities are an element of the effective protection of individuals in the processing of personal data;
Considering the importance of the circulation of information among peoples;
Considering that, with the intensified exchange of personal data across borders, it is necessary to ensure the effective protection of human rights and fundamental freedoms, including the right to privacy, in relation to such exchanges,
agreed that:
Article 1
Control authorities
1. Each Party provides that one or more authorities shall be responsible for ensuring compliance with the principles set out in chapters I and III of the Convention and in this Protocol.
2 (a) For this purpose, these authorities have powers of investigation and intervention, as well as to bring to justice or to bring to the knowledge of the competent judicial authority violations of the provisions of domestic law giving effect to the principles referred to in paragraph 1 of Article 1 of this Protocol.
(b) Each supervisory authority may be seized by any person of a request relating to the protection of its fundamental rights and freedoms with respect to the processing of personal data under its jurisdiction.
3. The supervisory authorities exercise their functions independently.
4. The decisions of the adjudicating supervisory authorities may be subject to judicial review.
5. In accordance with the provisions of Chapter IV and without prejudice to the provisions of Article 13 of the Convention, the supervisory authorities shall cooperate with each other to the extent necessary to carry out their duties, including by exchanging any relevant information.
Article 2
Transboundary flow of personal data to a recipient not subject to the jurisdiction of a Party to the Convention
1. Each Party shall provide that the transfer of personal data to a consignee subject to the jurisdiction of a State or organization that is not a Party to the Convention shall be effected only if that State or organization provides an adequate level of protection for the transfer.
2. By derogation from Article 2, paragraph 1, of this Protocol, each Party may authorize the transfer of personal data:
(a) If domestic law provides:
- for specific interests of the data subject, or
- where legitimate interests prevail, especially important public interests, or
(b) If guarantees that may, inter alia, result from contractual clauses are provided by the person responsible for the transfer, and are deemed sufficient by the competent authorities in accordance with domestic law.
Article 3
Final provisions
1. Parties shall consider the provisions of Articles 1 and 2 of this Protocol as additional articles to the Convention, and all provisions of the Convention shall apply accordingly.
2. This Protocol shall be open for signature by States signatories to the Convention. After acceding to the Convention under the conditions established by the Convention, the European Communities may sign this Protocol. This Protocol will be subject to ratification, acceptance or approval. A signatory to this Protocol shall not ratify, accept or approve it without having previously or simultaneously ratified, accepted or approved the Convention or without having acceded to it. Instruments for ratification, acceptance or approval of this Protocol shall be deposited with the Secretary-General of the Council of Europe.
3 (a) This Protocol shall enter into force on the first day of the month following the expiration of a period of three months after the date on which five of its signatories have expressed their consent to be bound by this Protocol in accordance with the provisions of Article 3, paragraph 2.
(b) For any signatory to this Protocol which subsequently expresses its consent to be bound by it, this Protocol shall enter into force on the first day of the month following the expiration of a period of three months after the date of deposit of its instrument of ratification, acceptance or approval.
4 (a) After the entry into force of this Protocol, any State that has acceded to the Convention may also accede to this Protocol.
(b) The accession shall be effected by the deposit, near the Secretary General of the Council of Europe, of an instrument of accession which shall take effect on the first day of the month following the expiration of a period of three months after the date of its deposit.
5 (a) Any Party may, at any time, denounce this Protocol by sending a notification to the Secretary-General of the Council of Europe.
(b) The denunciation shall take effect on the first day of the month following the expiration of a period of three months after the date of receipt of the notification by the Secretary-General.
6. The Secretary General of the Council of Europe shall notify the States members of the Council of Europe, the European Communities and any State that has acceded to this Protocol:
(a) Any signature;
(b) The deposit of any instrument of ratification, acceptance or approval;
(c) Any effective date of this Protocol in accordance with Article 3;
(d) Any other act, notification or communication relating to this Protocol.
In faith, the undersigned, duly authorized to do so, have signed this Protocol.
Done in Strasbourg on 8 November 2001, in French and English, both texts being equally authentic, in a single copy which will be deposited in the archives of the Council of Europe. The Secretary General of the Council of Europe shall transmit certified copies thereof to each Member State of the Council of Europe, the European Communities and any State invited to accede to the Convention.
Done in Paris, September 28, 2007.
Nicolas Sarkozy
By the President of the Republic:
The Prime Minister,
François Fillon
Minister for Foreign Affairs
and European,
Bernard Kouchner
