Zakon o ratifikaciji Protokola o spremembi Konvencije o varstvu posameznikov glede na avtomatsko obdelavo osebnih podatkov (MKVP-1)

Ratificira se Protokol o spremembi Konvencije o varstvu posameznikov glede na avtomatsko obdelavo osebnih podatkov, sklenjen v Strasbourgu 10. oktobra 2018.

Besedilo sporazuma se v izvirniku v angleškem jeziku ter v prevodu v slovenskem jeziku glasi: The member States of the Council of Europe and the other Parties to the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (ETS No. 108), opened for signature in Strasbourg on 28 January 1981 (hereinafter referred to as “the Convention”), Having regard to Resolution No. 3 on data protection and privacy in the third millennium adopted at the 30th Council of Europe Conference of Ministers of Justice (Istanbul, Turkey, 24-26 November 2010); Having regard to the Parliamentary Assembly of the Council of Europe’s Resolution 1843

(2011)on the protection of privacy and personal data on the Internet and online media and Resolution 1986

(2014)on improving user protection and security in cyberspace; Having regard to Opinion 296

(2017)on the draft protocol amending the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (ETS No. 108) and its explanatory memorandum, adopted by the Standing Committee on behalf of the Parliamentary Assembly of the Council of Europe on 24 November 2017; Considering that new challenges to the protection of individuals with regard to the processing of personal data have emerged since the Convention was adopted; Considering the need to ensure that the Convention continues to play its pre-eminent role in protecting individuals with regard to the processing of personal data, and more generally in protecting human rights and fundamental freedoms, Have agreed as follows: 1 The first recital of the preamble of the Convention shall be replaced by the following: “The member States of the Council of Europe, and the other signatories hereto,” 2 The third recital of the preamble of the Convention shall be replaced by the following: “Considering that it is necessary to secure the human dignity and protection of the human rights and fundamental freedoms of every individual and, given the diversification, intensification and globalisation of data processing and personal data flows, personal autonomy based on a person’s right to control his or her personal data and the processing of such data;” 3 The fourth recital of the preamble of the Convention shall be replaced by the following: “Recalling that the right to protection of personal data is to be considered in respect of its role in society and that it has to be reconciled with other human rights and fundamental freedoms, including freedom of expression;” 4 The following recital shall be added after the fourth recital of the preamble of the Convention: “Considering that this Convention permits account to be taken, in the implementation of the rules laid down therein, of the principle of the right of access to official documents;” 5 The fifth recital of the preamble of the Convention shall be deleted. New fifth and sixth recitals shall be added, which read as follows: “Recognising that it is necessary to promote at the global level the fundamental values of respect for privacy and protection of personal data, thereby contributing to the free flow of information between people;” “Recognising the interest of a reinforcement of international co-operation between the Parties to the Convention,” The text of Article 1 of the Convention shall be replaced by the following: “The purpose of this Convention is to protect every individual, whatever his or her nationality or residence, with regard to the processing of their personal data, thereby contributing to respect for his or her human rights and fundamental freedoms, and in particular the right to privacy.” 1 Littera b of Article 2 of the Convention shall be replaced by the following: “b ‘data processing’ means any operation or set of operations performed on personal data, such as the collection, storage, preservation, alteration, retrieval, disclosure, making available, erasure, or destruction of, or the carrying out of logical and/or arithmetical operations on such data;” 2 Littera c of Article 2 of the Convention shall be replaced by the following: “c where automated processing is not used, ‘data processing’ means an operation or set of operations performed upon personal data within a structured set of such data which are accessible or retrievable according to specific criteria;” 3 Littera d of Article 2 of the Convention shall be replaced by the following: “d ‘controller’ means the natural or legal person, public authority, service, agency or any other body which, alone or jointly with others, has decision-making power with respect to data processing;” 4 The following new litterae shall be added after littera d of Article 2 of the Convention: “e ‘recipient’ means a natural or legal person, public authority, service, agency or any other body to whom data are disclosed or made available; f ‘processor’ means a natural or legal person, public authority, service, agency or any other body which processes personal data on behalf of the controller.” 1 Paragraph 1 of Article 3 of the Convention shall be replaced by the following: “1 Each Party undertakes to apply this Convention to data processing subject to its jurisdiction in the public and private sectors, thereby securing every individual’s right to protection of his or her personal data.” 2 Paragraph 2 of Article 3 of the Convention shall be replaced by the following: “2 This Convention shall not apply to data processing carried out by an individual in the course of purely personal or household activities.” 3 Paragraphs 3 to 6 of Article 3 of the Convention shall be deleted. The title of Chapter II of the Convention shall be replaced by the following: “Chapter II – Basic principles for the protection of personal data”. 1 Paragraph 1 of Article 4 of the Convention shall be replaced by the following: “1 Each Party shall take the necessary measures in its law to give effect to the provisions of this Convention and secure their effective application.” 2 Paragraph 2 of Article 4 of the Convention shall be replaced by the following: “2 These measures shall be taken by each Party and shall have come into force by the time of ratification or of accession to this Convention.” 3 A new paragraph shall be added after paragraph 2 of Article 4 of the Convention: “3 Each Party undertakes: a to allow the Convention Committee provided for in Chapter VI to evaluate the effectiveness of the measures it has taken in its law to give effect to the provisions of this Convention; and b to contribute actively to this evaluation process.” 1 The title of Article 5 shall be replaced by the following: “Article 5 – Legitimacy of data processing and quality of data”. 2 The text of Article 5 of the Convention shall be replaced by the following: “1 Data processing shall be proportionate in relation to the legitimate purpose pursued and reflect at all stages of the processing a fair balance between all interests concerned, whether public or private, and the rights and freedoms at stake. 2 Each Party shall provide that data processing can be carried out on the basis of the free, specific, informed and unambiguous consent of the data subject or of some other legitimate basis laid down by law. 3 Personal data undergoing processing shall be processed lawfully. 4 Personal data undergoing processing shall be: a processed fairly and in a transparent manner; b collected for explicit, specified and legitimate purposes and not processed in a way incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes is, subject to appropriate safeguards, compatible with those purposes; c adequate, relevant and not excessive in relation to the purposes for which they are processed; d accurate and, where necessary, kept up to date; e preserved in a form which permits identification of the data subjects for no longer than is necessary for the purposes for which those data are processed.” The text of Article 6 of the Convention shall be replaced by the following: “1 The processing of: – genetic data; – personal data relating to offences, criminal proceedings and convictions, and related security measures; – biometric data uniquely identifying a person; – personal data for the information they reveal relating to racial or ethnic origin, political opinions, trade-union membership, religious or other beliefs, health or sexual life, shall only be allowed where appropriate safeguards are enshrined in law, complementing those of this Convention. 2 Such safeguards shall guard against the risks that the processing of sensitive data may present for the interests, rights and fundamental freedoms of the data subject, notably a risk of discrimination.” The text of Article 7 of the Convention shall be replaced by the following: “1 Each Party shall provide that the controller, and where applicable the processor, takes appropriate security measures against risks such as accidental or unauthorised access to, destruction, loss, use, modification or disclosure of personal data. 2 Each Party shall provide that the controller notifies, without delay, at least the competent supervisory authority within the meaning of Article 15 of this Convention, of those data breaches which may seriously interfere with the rights and fundamental freedoms of data subjects.” A new Article 8 shall be added after Article 7 of the Convention as follows: 1 Each Party shall provide that the controller informs the data subjects of: a his or her identity and habitual residence or establishment; b the legal basis and the purposes of the intended processing; c the categories of personal data processed; d the recipients or categories of recipients of the personal data, if any; and e the means of exercising the rights set out in Article 9, as well as any necessary additional information in order to ensure fair and transparent processing of the personal data. 2 Paragraph 1 shall not apply where the data subject already has the relevant information. 3 Where the personal data are not collected from the data subjects, the controller shall not be required to provide such information where the processing is expressly prescribed by law or this proves to be impossible or involves disproportionate efforts.” 1 The former Article 8 of the Convention shall be renumbered Article 9 and the title shall be replaced by the following: “Article 9 – Rights of the data subject”. 2 The text of Article 8 of the Convention (new Article 9) shall be replaced by the following: “1 Every individual shall have a right: a not to be subject to a decision significantly affecting him or her based solely on an automated processing of data without having his or her views taken into consideration; b to obtain, on request, at reasonable intervals and without excessive delay or expense, confirmation of the processing of personal data relating to him or her, the communication in an intelligible form of the data processed, all available information on their origin, on the preservation period as well as any other information that the controller is required to provide in order to ensure the transparency of processing in accordance with Article 8, paragraph 1; c to obtain, on request, knowledge of the reasoning underlying data processing where the results of such processing are applied to him or her; d to object at any time, on grounds relating to his or her situation, to the processing of personal data concerning him or her unless the controller demonstrates legitimate grounds for the processing which override his or her interests or rights and fundamental freedoms; e to obtain, on request, free of charge and without excessive delay, rectification or erasure, as the case may be, of such data if these are being, or have been, processed contrary to the provisions of this Convention; f to have a remedy under Article 12 where his or her rights under this Convention have been violated; g to benefit, whatever his or her nationality or residence, from the assistance of a supervisory authority within the meaning of Article 15, in exercising his or her rights under this Convention. 2 Paragraph 1.a shall not apply if the decision is authorised by a law to which the controller is subject and which also lays down suitable measures to safeguard the data subject's rights, freedoms and legitimate interests.” A new Article 10 shall be added after the new Article 9 of the Convention as follows: 1 Each Party shall provide that controllers and, where applicable, processors, take all appropriate measures to comply with the obligations of this Convention and be able to demonstrate, subject to the domestic legislation adopted in accordance with Article 11, paragraph 3, in particular to the competent supervisory authority provided for in Article 15, that the data processing under their control is in compliance with the provisions of this Convention. 2 Each Party shall provide that controllers and, where applicable, processors, examine the likely impact of intended data processing on the rights and fundamental freedoms of data subjects prior to the commencement of such processing, and shall design the data processing in such a manner as to prevent or minimise the risk of interference with those rights and fundamental freedoms. 3 Each Party shall provide that controllers, and, where applicable, processors, implement technical and organisational measures which take into account the implications of the right to the protection of personal data at all stages of the data processing. 4 Each Party may, having regard to the risks arising for the interests, rights and fundamental freedoms of the data subjects, adapt the application of the provisions of paragraphs 1, 2 and 3 in the law giving effect to the provisions of this Convention, according to the nature and volume of the data, the nature, scope and purpose of the processing and, where appropriate, the size of the controller or processor.” The former Articles 9 to 12 of the Convention shall become Articles 11 to 14 of the Convention. The text of Article 9 of the Convention (new Article 11) shall be replaced by the following: “1 No exception to the provisions set out in this chapter shall be allowed except to the provisions of Article 5, paragraph 4, Article 7, paragraph 2, Article 8, paragraph 1 and Article 9, when such an exception is provided for by law, respects the essence of the fundamental rights and freedoms and constitutes a necessary and proportionate measure in a democratic society for: a the protection of national security, defence, public safety, important economic and financial interests of the State, the impartiality and independence of the judiciary or the prevention, investigation and prosecution of criminal offences and the execution of criminal penalties, and other essential objectives of general public interest; b the protection of the data subject or the rights and fundamental freedoms of others, notably freedom of expression. 2 Restrictions on the exercise of the provisions specified in Articles 8 and 9 may be provided for by law with respect to data processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes when there is no recognisable risk of infringement of the rights and fundamental freedoms of data subjects. 3 In addition to the exceptions allowed for in paragraph 1 of this article, with reference to processing activities for national security and defence purposes, each Party may provide, by law and only to the extent that it constitutes a necessary and proportionate measure in a democratic society to fulfil such an aim, exceptions to Article 4 paragraph 3, Article 14, paragraphs 5 and 6 and Article 15, paragraph 2, litterae a, b, c and d. This is without prejudice to the requirement that processing activities for national security and defence purposes are subject to independent and effective review and supervision under the domestic legislation of the respective Party.” The text of Article 10 of the Convention (new Article 12) shall be replaced by the following: “Each Party undertakes to establish appropriate judicial and non-judicial sanctions and remedies for violations of the provisions of this Convention.” The title of Chapter III shall be replaced by the following: “Chapter III – Transborder flows of personal data”. 1 The title of Article 12 of the Convention (new Article 14) shall be replaced by the following: “Article 14 – Transborder flows of personal data”. 2 The text of Article 12 of the Convention (new Article 14) shall be replaced by the following: “1 A Party shall not, for the sole purpose of the protection of personal data, prohibit or subject to special authorisation the transfer of such data to a recipient who is subject to the jurisdiction of another Party to the Convention. Such a Party may, however, do so if there is a real and serious risk that the transfer to another Party, or from that other Party to a non-Party, would lead to circumventing the provisions of the Convention. A Party may also do so if bound by harmonised rules of protection shared by States belonging to a regional international organisation. 2 When the recipient is subject to the jurisdiction of a State or international organisation which is not Party to this Convention, the transfer of personal data may only take place where an appropriate level of protection based on the provisions of this Convention is secured. 3 An appropriate level of protection can be secured by: a the law of that State or international organisation, including the applicable international treaties or agreements; or b ad hoc or approved standardised safeguards provided by legally-binding and enforceable instruments adopted and implemented by the persons involved in the transfer and further processing. 4 Notwithstanding the provisions of the previous paragraphs, each Party may provide that the transfer of personal data may take place if: a the data subject has given explicit, specific and free consent, after being informed of risks arising in the absence of appropriate safeguards; or b the specific interests of the data subject require it in the particular case; or c prevailing legitimate interests, in particular important public interests, are provided for by law and such transfer constitutes a necessary and proportionate measure in a democratic society; or d it constitutes a necessary and proportionate measure in a democratic society for freedom of expression. 5 Each Party shall provide that the competent supervisory authority, within the meaning of Article 15 of this Convention, is provided with all relevant information concerning the transfers of data referred to in paragraph 3, littera b and, upon request, paragraph 4, litterae b and c. 6 Each Party shall also provide that the supervisory authority is entitled to request that the person who transfers data demonstrates the effectiveness of the safeguards or the existence of prevailing legitimate interests and that the supervisory authority may, in order to protect the rights and fundamental freedoms of data subjects, prohibit such transfers, suspend them or subject them to conditions.” 3 The text of Article 12 of the Convention (new Article 14) includes the provisions of Article 2 of the Additional Protocol of 2001 regarding supervisory authorities and transborder data flows (ETS No. 181) on transborder flows of personal data to a recipient which is not subject to the jurisdiction of a Party to the Convention. A new Chapter IV shall be added after Chapter III of the Convention, as follows: “Chapter IV – Supervisory authorities”. A new Article 15 includes the provisions of Article 1 of the Additional Protocol of 2001 (ETS No.181) and reads as follows: 1 Each Party shall provide for one or more authorities to be responsible for ensuring compliance with the provisions of this Convention. 2 To this end, such authorities: a shall have powers of investigation and intervention; b shall perform the functions relating to transfers of data provided for under Article 14, notably the approval of standardised safeguards; c shall have powers to issue decisions with respect to violations of the provisions of this Convention and may, in particular, impose administrative sanctions; d shall have the power to engage in legal proceedings or to bring to the attention of the competent judicial authorities violations of the provisions of this Convention; e shall promote: i public awareness of their functions and powers, as well as their activities; ii public awareness of the rights of data subjects and the exercise of such rights; iii awareness of controllers and processors of their responsibilities under this Convention; specific attention shall be given to the data protection rights of children and other vulnerable individuals. 3 The competent supervisory authorities shall be consulted on proposals for any legislative or administrative measures which provide for the processing of personal data. 4 Each competent supervisory authority shall deal with requests and complaints lodged by data subjects concerning their data protection rights and shall keep data subjects informed of progress. 5 The supervisory authorities shall act with complete independence and impartiality in performing their duties and exercising their powers and in doing so shall neither seek nor accept instructions. 6 Each Party shall ensure that the supervisory authorities are provided with the resources necessary for the effective performance of their functions and exercise of their powers. 7 Each supervisory authority shall prepare and publish a periodical report outlining its activities. 8 Members and staff of the supervisory authorities shall be bound by obligations of confidentiality with regard to confidential information to which they have access, or have had access to, in the performance of their duties and exercise of their powers. 9 Decisions of the supervisory authorities may be subject to appeal through the courts. 10 The supervisory authorities shall not be competent with respect to processing carried out by bodies when acting in their judicial capacity.” 1 Chapters IV to VII of the Convention shall be renumbered to Chapters V to VIII of the Convention. 2 The title of Chapter V shall be replaced by “Chapter V – Co-operation and mutual assistance”. 3 A new Article 17 shall be added, and former Articles 13 to 27 of the Convention shall become Articles 16 to 31 of the Convention. 1 The title of Article 13 of the Convention (new Article 16) shall be replaced by the following: “Article 16 – Designation of supervisory authorities”. 2 Paragraph 1 of Article 13 of the Convention (new Article 16) shall be replaced by the following: “1 The Parties agree to co-operate and render each other mutual assistance in order to implement this Convention.” 3 Paragraph 2 of Article 13 of the Convention (new Article 16) shall be replaced by the following: “2 For that purpose: a each Party shall designate one or more supervisory authorities within the meaning of Article 15 of this Convention, the name and address of each of which it shall communicate to the Secretary General of the Council of Europe; b each Party which has designated more than one supervisory authority shall specify the competence of each authority in its communication referred to in the previous littera.” 4 Paragraph 3 of Article 13 of the Convention (new Article 16) shall be deleted. A new Article 17 shall be added after the new Article 16 of the Convention as follows: 1 The supervisory authorities shall co-operate with one another to the extent necessary for the performance of their duties and exercise of their powers, in particular by: a providing mutual assistance by exchanging relevant and useful information and co-operating with each other under the condition that, as regards the protection of personal data, all the rules and safeguards of this Convention are complied with; b co-ordinating their investigations or interventions, or conducting joint actions; c providing information and documentation on their law and administrative practice relating to data protection. 2 The information referred to in paragraph 1 shall not include personal data undergoing processing unless such data are essential for co-operation, or where the data subject concerned has given explicit, specific, free and informed consent to its provision. 3 In order to organise their co-operation and to perform the duties set out in the preceding paragraphs, the supervisory authorities of the Parties shall form a network.” 1 The title of Article 14 of the Convention (new Article 18) shall be replaced by the following: “Article 18 – Assistance to data subjects”. 2 The text of Article 14 of the Convention (new Article 18) shall be replaced by the following: “1 Each Party shall assist any data subject, whatever his or her nationality or residence, to exercise his or her rights under Article 9 of this Convention. 2 Where a data subject resides on the territory of another Party, he or she shall be given the option of submitting the request through the intermediary of the supervisory authority designated by that Party. 3 The request for assistance shall contain all the necessary particulars, relating inter alia to: a the name, address and any other relevant particulars identifying the data subject making the request; b the processing to which the request pertains, or its controller; c the purpose of the request.” 1 The title of Article 15 of the Convention (new Article 19) shall be replaced by the following: “Article 19 – Safeguards”. 2 The text of Article 15 of the Convention (new Article 19) shall be replaced by the following: “1 A supervisory authority which has received information from another supervisory authority, either accompanying a request or in reply to its own request, shall not use that information for purposes other than those specified in the request. 2 In no case may a supervisory authority be allowed to make a request on behalf of a data subject of its own accord and without the express approval of the data subject concerned.” 1 The title of Article 16 of the Convention (new Article 20) shall be replaced by the following: “Article 20 – Refusal of requests”. 2 The recital of Article 16 of the Convention (new Article 20) shall be replaced by the following: “A supervisory authority to which a request is addressed under Article 17 of this Convention may not refuse to comply with it unless:” 3 Littera a of Article 16 of the Convention (new Article 20) shall be replaced by the following: “a the request is not compatible with its powers.” 4 Littera c of Article 16 of the Convention (new Article 20) shall be replaced by the following: “c compliance with the request would be incompatible with the sovereignty, national security or public order of the Party by which it was designated, or with the rights and fundamental freedoms of individuals under the jurisdiction of that Party.” 1 The title of Article 17 of the Convention (new Article 21) shall be replaced by the following: “Article 21 – Costs and procedures”. 2 Paragraph 1 of Article 17 of the Convention (new Article 21) shall be replaced by the following: “1 Co-operation and mutual assistance which the Parties render each other under Article 17 and assistance they render to data subjects under Articles 9 and 18 shall not give rise to the payment of any costs or fees other than those incurred for experts and interpreters. The latter costs or fees shall be borne by the Party making the request.” 3 The terms “his or her” shall replace “his” in paragraph 2 of Article 17 of the Convention (new Article 21). The title of Chapter V of the Convention (new Chapter VI) shall be replaced by the following: “Chapter VI – Convention Committee”. 1 The terms “Consultative Committee” in paragraph 1 of Article 18 of the Convention (new Article 22) shall be replaced by “Convention Committee”. 2 Paragraph 3 of Article 18 of the Convention (new Article 22) shall be replaced by the following: “3 The Convention Committee may, by a decision taken by a majority of two-thirds of the representatives of the Parties, invite an observer to be represented at its meetings.” 3 A new paragraph 4 shall be added after paragraph 3 of Article 18 of the Convention (new Article 22): “4 Any Party which is not a member of the Council of Europe shall contribute to the funding of the activities of the Convention Committee according to the modalities established by the Committee of Ministers in agreement with that Party.” 1 The terms “Consultative Committee” in the recital of Article 19 of the Convention (new Article 23) shall be replaced by “Convention Committee”. 2 The term “proposals” in littera a of Article 19 of the Convention (new Article 23) shall be replaced with the term “recommendations”. 3 References to “Article 21” in littera b and “Article 21 paragraph 3” in littera c of Article 19 of the Convention (new Article 23) shall be replaced respectively by references to “Article 25” and “Article 25, paragraph 3”. 4 Littera d of Article 19 of the Convention (new Article 23) shall be replaced by the following: “d. may express an opinion on any question concerning the interpretation or application of this Convention;”. 5 The following additional litterae shall be added following littera d of Article 19 of the Convention (new Article 23): “e shall prepare, before any new accession to the Convention, an opinion for the Committee of Ministers relating to the level of personal data protection of the candidate for accession and, where necessary, recommend measures to take to reach compliance with the provisions of this Convention; f may, at the request of a State or an international organisation, evaluate whether the level of personal data protection the former provides is in compliance with the provisions of this Convention and, where necessary, recommend measures to be taken in order to reach such compliance; g may develop or approve models of standardised safeguards referred to in Article 14; h shall review the implementation of this Convention by the Parties and recommend measures to be taken in the case where a Party is not in compliance with this Convention; i shall facilitate, where necessary, the friendly settlement of all difficulties related to the application of this Convention.” The text of Article 20 of the Convention (new Article 24) shall be replaced by the following: “1 The Convention Committee shall be convened by the Secretary General of the Council of Europe. Its first meeting shall be held within twelve months of the entry into force of this Convention. It shall subsequently meet at least once a year, and in any case when one-third of the representatives of the Parties request its convocation. 2 After each of its meetings, the Convention Committee shall submit to the Committee of Ministers of the Council of Europe a report on its work and on the functioning of this Convention. 3 The voting arrangements in the Convention Committee are laid down in the elements for the rules of procedure appended to Protocol CETS No. [223]. 4 The Convention Committee shall draw up the other elements of its rules of procedure and establish, in particular, the procedures for evaluation and review referred to in Article 4, paragraph 3, and Article 23, litterae e, f and h on the basis of objective criteria.” 1 Paragraphs 1 to 4 of Article 21 of the Convention (new Article 25) shall be replaced by the following: “1 Amendments to this Convention may be proposed by a Party, the Committee of Ministers of the Council of Europe or the Convention Committee. 2 Any proposal for amendment shall be communicated by the Secretary General of the Council of Europe to the Parties to this Convention, to the other member States of the Council of Europe, to the European Union and to every non-member State or international organisation which has been invited to accede to this Convention in accordance with the provisions of Article 28. 3 Moreover, any amendment proposed by a Party or the Committee of Ministers shall be communicated to the Convention Committee, which shall submit to the Committee of Ministers its opinion on that proposed amendment. 4 The Committee of Ministers shall consider the proposed amendment and any opinion submitted by the Convention Committee, and may approve the amendment.” 2 An additional paragraph 7 shall be added after paragraph 6 of Article 21 of the Convention (new Article 25) as follows: “7 Moreover, the Committee of Ministers may, after consulting the Convention Committee, unanimously decide that a particular amendment shall enter into force at the expiration of a period of three years from the date on which it has been opened to acceptance, unless a Party notifies the Secretary General of the Council of Europe of an objection to its entry into force. If such an objection is notified, the amendment shall enter into force on the first day of the month following the date on which the Party to this Convention which has notified the objection has deposited its instrument of acceptance with the Secretary General of the Council of Europe.” 1 Paragraph 1 of Article 22 of the Convention (new Article 26) shall be replaced by the following: “1 This Convention shall be open for signature by the member States of the Council of Europe and by the European Union. It is subject to ratification, acceptance or approval. Instruments of ratification, acceptance or approval shall be deposited with the Secretary General of the Council of Europe.” 2 The terms “member State” in paragraph 3 of Article 22 of the Convention (new Article 26) shall be replaced by “Party”. The title and the text of Article 23 of the Convention (new Article 27) shall be replaced as follows: 1 After the entry into force of this Convention, the Committee of Ministers of the Council of Europe may, after consulting the Parties to this Convention and obtaining their unanimous agreement, and in light of the opinion prepared by the Convention Committee in accordance with Article 23.e, invite any State not a member of the Council of Europe or an international organisation to accede to this Convention by a decision taken by the majority provided for in Article 20.d of the Statute of the Council of Europe and by the unanimous vote of the representatives of the Contracting States entitled to sit on the Committee of Ministers. 2 In respect of any State or international organisation acceding to this Convention according to paragraph 1 above, the Convention shall enter into force on the first day of the month following the expiration of a period of three months after the date of deposit of the instrument of accession with the Secretary General of the Council of Europe.” Paragraphs 1 and 2 of Article 24 of the Convention (new Article 28) shall be replaced by the following: “1 Any State, the European Union or other international organisation may, at the time of signature or when depositing its instrument of ratification, acceptance, approval or accession, specify the territory or territories to which this Convention shall apply. 2 Any State, the European Union or other international organisation may, at any later date, by a declaration addressed to the Secretary General of the Council of Europe, extend the application of this Convention to any other territory specified in the declaration. In respect of such territory the Convention shall enter into force on the first day of the month following the expiration of a period of three months after the date of receipt of such declaration by the Secretary General.” 1 The term “State” in the recital of Article 27 of the Convention (new Article 31) shall be replaced by “Party”. 2 References to “Articles 22, 23 and 24” in littera c shall be replaced by references to “Articles 26, 27 and 28”. 1 This Protocol shall be open for signature by Contracting States to the Convention. It shall be subject to ratification, acceptance or approval. Instruments of ratification, acceptance or approval shall be deposited with the Secretary General of the Council of Europe. 2 After the opening for signature of this Protocol and before its entry into force, any other State shall express its consent to be bound by this Protocol by accession. It may not become a Party to the Convention without acceding simultaneously to this Protocol. 1 This Protocol shall enter into force on the first day of the month following the expiration of a period of three months after the date on which all Parties to the Convention have expressed their consent to be bound by the Protocol, in accordance with the provisions of paragraph 1 of Article 36. 2 In the event this Protocol has not entered into force in accordance with paragraph 1, following the expiry of a period of five years after the date on which it has been opened for signature, the Protocol shall enter into force in respect of those States which have expressed their consent to be bound by it in accordance with paragraph 1, provided that the Protocol has at least thirty-eight Parties. As between the Parties to the Protocol, all provisions of the amended Convention shall have effect immediately upon entry into force. 3 Pending the entry into force of this Protocol and without prejudice to the provisions regarding the entry into force and the accession by non-member States or international organisations, a Party to the Convention may, at the time of signature of this Protocol or at any later moment, declare that it will apply the provisions of this Protocol on a provisional basis. In such cases, the provisions of this Protocol shall apply only with respect to the other Parties to the Convention which have made a declaration to the same effect. Such a declaration shall take effect on the first day of the third month following the date of its receipt by the Secretary General of the Council of Europe. 4 From the date of entry into force of this Protocol, the Additional Protocol to the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, regarding supervisory authorities and transborder data flows (ETS No. 181) shall be repealed. 5 From the date of the entry into force of this Protocol, the amendments to the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, approved by the Committee of Ministers, in Strasbourg, on 15 June 1999, have lost their purpose. From the date of entry into force of this Protocol, with respect to a Party having entered one or more declarations in pursuance of Article 3 of the Convention, such declaration(s) will lapse. No reservation may be made to the provisions of this Protocol. The Secretary General of the Council of Europe shall notify the member States of the Council of Europe and any other Party to the Convention of: a any signature; b the deposit of any instrument of ratification, acceptance, approval or accession; c the date of entry into force of this Protocol in accordance with Article 37; d any other act, notification or communication relating to this Protocol. In witness whereof the undersigned, being duly authorised thereto, have signed this Protocol. Done at Strasbourg, this 10 thday of October 2018, in English and in French, both texts being equally authentic, in a single copy which shall be deposited in the archives of the Council of Europe. The Secretary General of the Council of Europe shall transmit certified copies to each member State of the Council of Europe, to other Parties to the Convention and any State invited to accede to the Convention. Appendix to the Protocol: Elements for the rules of procedure of the Convention Committee 1 Each Party has a right to vote and shall have one vote. 2 A two-thirds majority of representatives of the Parties shall constitute a quorum for the meetings of the Convention Committee. In case the amending Protocol to the Convention enters into force in accordance with its Article 37

(2)before its entry into force in respect of all Contracting States to the Convention, the quorum for the meetings of the Convention Committee shall be no less than 34 Parties to the Protocol. 3 The decisions under Article 23 shall be taken by a four- fifths majority. The decisions pursuant to Article 23 littera h shall be taken by a four-fifths majority, including a majority of the votes of States Parties not members of a regional integration organisation that is a Party to the Convention. 4 Where the Convention Committee takes decisions pursuant to Article 23 littera h, the Party concerned by the review shall not vote. Whenever such a decision concerns a matter falling within the competence of a regional integration organisation, neither the organisation nor its member States shall vote. 5 Decisions concerning procedural issues shall be taken by a simple majority. 6 Regional integration organisations, in matters within their competence, may exercise their right to vote in the Convention Committee, with a number of votes equal to the number of their member States that are Parties to the Convention. Such an organisation shall not exercise its right to vote if any of its member States exercises its right. 7 In case of vote, all Parties must be informed of the subject and time for the vote, as well as whether the vote will be exercised by the Parties individually or by a regional integration organisation on behalf of its member States. 8 The Convention Committee may further amend its rules of procedure by a two-thirds majority, except for the voting arrangements which may only be amended by unanimous vote of the Parties and to which Article 25 of the Convention applies.« Države članice Sveta Evrope in druge pogodbenice Konvencije o varstvu posameznikov glede na avtomatsko obdelavo osebnih podatkov (ETS št. 108), ki je bila dana na voljo za podpis v Strasbourgu 28. januarja 1981 (v nadaljnjem besedilu: konvencija) so se ob upoštevanju Resolucije št. 3 o varstvu podatkov in zasebnosti v tretjem tisočletju, ki je bila sprejeta na 30. konferenci ministrov za pravosodje Sveta Evrope (Istanbul, Turčija, 24.–26. november 2010); ob upoštevanju Resolucije 1843

(2011)Parlamentarne skupščine Sveta Evrope o varstvu zasebnosti in osebnih podatkov na internetu in v spletnih medijih ter Resolucije 1986

(2014)o izboljšanju varstva uporabnikov in varnosti v kibernetskem prostoru; ob upoštevanju Mnenja 296

(2017)o osnutku protokola o spremembi Konvencije o varstvu posameznikov glede na avtomatsko obdelavo osebnih podatkov (ETS št. 108) in obrazložitvenega poročila, ki ju je v imenu Parlamentarne skupščine Sveta Evrope sprejel Stalni odbor 24. novembra 2017; ob upoštevanju novih izzivov, ki so se pojavili v zvezi z varstvom posameznikov pri obdelavi osebnih podatkov po sprejetju konvencije; ob upoštevanju potrebe, da konvencija ohrani prevladujočo vlogo pri varstvu posameznikov glede obdelave osebnih podatkov in na splošno pri varstvu človekovih pravic in temeljnih svoboščin, dogovorile:

1 Prva uvodna izjava preambule h konvenciji se nadomesti z besedilom: »Države članice Sveta Evrope in druge podpisnice konvencije,«. 2 Tretja uvodna izjava preambule h konvenciji se nadomesti z besedilom: »ob upoštevanju, da je treba zagotoviti človekovo dostojanstvo ter varstvo človekovih pravic in temeljnih svoboščin vsakega posameznika, ter glede na razvejanost, stopnjevanje in globalizacijo obdelave podatkov in pretok osebnih podatkov tudi osebno samostojnost na podlagi pravice nadzorovati lastne osebne podatke in njihovo obdelavo,«. 3 Četrta uvodna izjava preambule h konvenciji se nadomesti z besedilom: »ob upoštevanju, da je treba pravico do varstva osebnih podatkov obravnavati glede na njeno vlogo v družbi in dejstvo, da jo je treba uskladiti z drugimi človekovimi pravicami in temeljnimi svoboščinami, tudi svobodo izražanja,«. 4 Za četrto uvodno izjavo preambule h konvenciji se doda naslednje besedilo: »ob upoštevanju, da izvajanje pravil, določenih v konvenciji, omogoča spoštovanje načela pravice do dostopa do uradnih dokumentov,«. 5 Peta uvodna izjava preambule h konvenciji se črta. Dodata se novi peta in šesta uvodna izjava: »ob spoznanju, da je treba spodbujati temeljne vrednote spoštovanja zasebnosti in varstva osebnih podatkov na svetovni ravni in tako prispevati k prostemu pretoku informacij med ljudmi, ob priznavanju interesa okrepiti mednarodno sodelovanje med pogodbenicami konvencije,«.

Besedilo 1. člena konvencije se nadomesti z besedilom: »Namen konvencije je varovati vsakega posameznika glede obdelave njegovih osebnih podatkov ne glede na njegovo državljanstvo ali prebivališče ter tako prispevati k spoštovanju njegovih človekovih pravic in temeljnih svoboščin, predvsem pravice do zasebnosti.«.

1 Točka b) 2. člena konvencije se nadomesti z besedilom: »b) »obdelava podatkov« pomeni vsako dejanje ali niz dejanj, ki se izvajajo v zvezi z osebnimi podatki, kot je zbiranje, shranjevanje, ohranjanje, spreminjanje, priklic, razkrivanje, omogočanje dostopa, izbris, uničenje ali izvajanje logičnih in/ali računskih operacij pri delu s temi podatki,«. 2 Točka c) 2. člena konvencije se nadomesti z besedilom: »c) če ne gre za avtomatizirano obdelavo podatkov, pomeni »obdelava podatkov« dejanje ali niz dejanj, ki se izvajajo z osebnimi podatki v strukturiranem nizu podatkov, ki so dostopni ali jih je mogoče priklicati v skladu s posebnimi merili,«. 3 Točka d) 2. člena konvencije se nadomesti z besedilom: »d) »upravljavec« pomeni fizično ali pravno osebo, javni organ, službo, agencijo ali drugo telo, ki je samo ali skupaj z drugimi pristojno za odločanje o obdelavi podatkov,«. 4 Za točko d) 2. člena konvencije se dodata naslednji novi točki: »e) »uporabnik« pomeni fizično ali pravno osebo, javni organ, službo, agencijo ali drugo telo, ki so mu podatki razkriti ali mu je omogočen dostop do njih, f) »obdelovalec« pomeni fizično ali pravno osebo, javni organ, službo, agencijo ali drugo telo, ki obdeluje osebne podatke v imenu upravljavca.«.

1 Prvi odstavek 3. člena konvencije se nadomesti z besedilom: »1. Vsaka pogodbenica se zaveže uporabljati konvencijo pri obdelavi podatkov v svoji pristojnosti v javnem in zasebnem sektorju ter tako vsakemu posamezniku zagotoviti pravico do varstva osebnih podatkov.«. 2 Drugi odstavek 3. člena konvencije se nadomesti z besedilom: »2. Konvencija se ne uporablja za podatke, ki jih obdeluje posameznik v okviru izključno osebne ali domače dejavnosti.«. 3 Tretji do šesti odstavek 3. člena konvencije se črtajo.

Naslov II. poglavja konvencije se nadomesti z besedilom: »II. poglavje – temeljna načela varstva osebnih podatkov«.

1 Prvi odstavek 4. člena konvencije se nadomesti z besedilom: »1. Vsaka pogodbenica v svoji zakonodaji sprejme potrebne ukrepe za učinkovanje določb konvencije in zagotovi njihovo učinkovito uporabo.«. 2 Drugi odstavek 4. člena konvencije se nadomesti z besedilom: »2. Vsaka pogodbenica te ukrepe sprejme in ti ukrepi začnejo veljati pred ratifikacijo konvencije ali pristopom k njej.«. 3 Za drugim odstavkom 4. člena konvencije se doda nov odstavek: »3. Vsaka pogodbenica se zaveže: a) omogočiti odboru konvencije iz VI. poglavja, da oceni učinkovitost ukrepov, ki jih je sprejela v svoji zakonodaji za učinkovanje določb konvencije, in b) dejavno prispevati k postopku ocenjevanja.«.

1 Naslov 5. člena se nadomesti z besedilom: »5. člen – zakonitost obdelave podatkov in kakovost podatkov.«. 2 Besedilo 5. člena konvencije se nadomesti z besedilom: »1. Obdelava podatkov mora biti sorazmerna glede na zakoniti namen in na vseh stopnjah odražati pošteno ravnovesje med vsemi interesi, javnimi ali zasebnimi, ter zadevnimi pravicami in svoboščinami.«. 2. Vsaka pogodbenica zagotovi, da se podatki lahko obdelujejo na podlagi prostovoljne, konkretne, informirane in nedvoumno izražene privolitve posameznika, na katerega se nanašajo osebni podatki, ali na drugi upravičeni, z zakonom določeni podlagi. 3 Osebne podatke, ki se obdelujejo, je treba obdelovati zakonito. 4 Osebni podatki, ki se obdelujejo, so: a) obdelani pošteno in pregledno; b) zbrani za izrecne, določene in zakonite namene in se ne smejo obdelovati na način, ki ni združljiv s temi nameni; nadaljnja obdelava za arhiviranje v javnem interesu, za znanstvenoraziskovalne ali zgodovinskoraziskovalne ali statistične namene je ob upoštevanju ustreznih zaščitnih ukrepov združljiva s temi nameni; c) ustrezni, relevantni in ne pretirani glede na namene, za katere se obdelujejo; d) točni, in kadar je to potrebno, posodobljeni; e) hranjeni v obliki, ki dopušča identifikacijo posameznikov, na katere se nanašajo osebni podatki, le toliko časa, kolikor je to potrebno za namene, za katere se ti podatki obdelujejo.«.

Besedilo 6. člena konvencije se nadomesti z besedilom: »1. Obdelava: – genskih podatkov; – osebnih podatkov o prekrških, kazenskih postopkih in obsodbah ter s tem povezanih varnostnih ukrepih; – biometričnih podatkov za edinstveno identifikacijo posameznika; – osebnih podatkov, ki razkrivajo rasno ali etnično poreklo, politično mnenje, članstvo v sindikatu, versko ali drugo prepričanje, zdravje ali spolno življenje, je dovoljena le, če so v zakonodaji določeni ustrezni zaščitni ukrepi, ki dopolnjujejo zaščitne ukrepe po konvenciji. 2. Taki zaščitni ukrepi varujejo pred tveganji, ki jih obdelava posebnih vrst osebnih podatkov lahko pomeni za interese, pravice in temeljne svoboščine posameznika, na katerega se nanašajo osebni podatki, zlasti pred tveganjem diskriminacije.«.

Besedilo 7. člena konvencije se nadomesti z besedilom: »1. Vsaka pogodbenica zagotovi, da upravljavec, in kadar je to primerno, obdelovalec sprejmeta ustrezne ukrepe za varovanje pred tveganji, kot je nenamerni ali nepooblaščeni dostop do osebnih podatkov, njihovo uničenje, izguba, uporaba, spreminjanje ali razkritje. 2. Vsaka pogodbenica zagotovi, da upravljavec brez odlašanja uradno obvesti vsaj pristojni nadzorni organ v smislu 15. člena konvencije o tistih kršitvah varstva podatkov, ki lahko resno posežejo v pravice in temeljne svoboščine posameznikov, na katere se nanašajo osebni podatki.«.

Za 7. členom konvencije se doda nov 8. člen: 1. Vsaka pogodbenica zagotovi, da upravljavec obvesti posameznike, na katere se nanašajo osebni podatki, o: a) svoji identiteti in običajnem prebivališču ali sedežu; b) zakonski podlagi in namenih predvidene obdelave podatkov; c) vrstah obdelovanih osebnih podatkov; d) uporabnikih ali vrstah morebitnih uporabnikov osebnih podatkov in e) načinih uresničevanja pravic iz 9. člena ter o vseh morebitnih dodatnih informacijah za zagotovitev poštene in pregledne obdelave osebnih podatkov. 2. Prvi odstavek se ne uporablja, če posameznik, na katerega se nanašajo osebni podatki, že ima ustrezne informacije. 3. Kadar se osebni podatki ne pridobijo od posameznikov, na katere se nanašajo, upravljavcu ni treba zagotoviti navedenih informacij, če je obdelava izrecno določena z zakonom, je to nemogoče ali vključuje nesorazmerne napore.«.

1 Dosedanji 8. člen konvencije postane 9. člen, naslov pa se nadomesti z naslovom: »9. člen – pravice posameznika, na katerega se nanašajo osebni podatki«. 2 Besedilo 8. člena konvencije (novi 9. člen) se nadomesti z besedilom: »1. Vsak posameznik ima pravico: a) da zanj ne velja odločitev, ki znatno vpliva nanj in temelji izključno na podlagi avtomatizirane obdelave podatkov, ne da bi se upoštevala njegova stališča; b) da na zahtevo, v razumnih časovnih razmikih in brez nepotrebnega odlašanja ali stroškov prejme potrditev o obdelavi osebnih podatkov, ki se nanašajo nanj, sporočilo o obdelanih podatkih v razumljivi obliki, vse razpoložljive informacije o njihovem izvoru, obdobju hrambe ter vse druge informacije, ki jih mora upravljavec dati za zagotovitev preglednosti obdelave v skladu s prvim odstavkom 8. člena; c) da je na zahtevo seznanjen z razlogi, na katerih temelji obdelava podatkov, kadar se izsledki take obdelave uporabljajo zanj; d) da zaradi razlogov, povezanih s svojim položajem, kadar koli ugovarja obdelavi osebnih podatkov, ki se nanašajo nanj, razen če upravljavec izkaže upravičene razloge za obdelavo, ki prevladajo nad posameznikovimi interesi ali pravicami in temeljnimi svoboščinami; e) da na zahtevo, brezplačno in brez nepotrebnega odlašanja doseže popravek ali izbris podatkov, odvisno od primera, če se obdelujejo ali so bili obdelani v nasprotju z določbami te konvencije; f) do pravnega sredstva iz 12. člena, če so bile kršene njegove pravice po tej konvenciji; g) do pomoči nadzornega organa v smislu 15. člena pri uresničevanju pravic iz konvencije ne glede na svoje državljanstvo ali prebivališče. 2. Točka a) prvega odstavka se ne uporablja, če je odločitev dovoljena z zakonom, ki velja za upravljavca in določa tudi primerne ukrepe za varovanje pravic, svoboščin in zakonitih interesov posameznika, na katerega se nanašajo osebni podatki.«.

Za novim 9. členom konvencije se doda nov 10. člen: 1. Vsaka pogodbenica zagotovi, da upravljavci, in kadar je to primerno, obdelovalci sprejmejo vse ustrezne ukrepe za izpolnjevanje obveznosti iz konvencije in da predvsem pristojnemu nadzornemu organu iz 15. člena lahko dokažejo, da je po notranji zakonodaji, sprejeti v skladu s tretjim odstavkom 11. člena, obdelava podatkov pod njihovim nadzorom v skladu z določbami konvencije. 2. Vsaka pogodbenica zagotovi, da upravljavci, in kadar je to primerno, obdelovalci pred začetkom obdelave proučijo verjetni vpliv predvidene obdelave podatkov na pravice in temeljne svoboščine posameznikov, na katere se nanašajo osebni podatki, ter da obdelavo podatkov načrtujejo tako, da preprečijo ali zmanjšajo tveganje poseganja v te pravice in temeljne svoboščine. 3. Vsaka pogodbenica zagotovi, da upravljavci, in kadar je to primerno, obdelovalci sprejmejo tehnične in organizacijske ukrepe, ki na vseh stopnjah obdelave podatkov upoštevajo njen vpliv na pravico do varstva osebnih podatkov. 4. Ob upoštevanju tveganj za interese, pravice in temeljne svoboščine posameznikov, na katere se nanašajo osebni podatki, lahko vsaka pogodbenica v zakonodaji, ki določbe konvencije uveljavlja, prilagodi uporabo določb prvega, drugega in tretjega odstavka glede na naravo in količino podatkov, način, obseg in namen obdelave, ter kadar je to primerno, velikost upravljavca ali obdelovalca.«.

Dosedanji 9. do 12. člen konvencije postanejo 11. do 14. člen konvencije.

Besedilo 9. člena konvencije (novi 11. člen) se nadomesti z besedilom: »1. V zvezi z določbami tega poglavja ni dovoljena nobena izjema, razen glede določb četrtega odstavka 5. člena, drugega odstavka 7. člena, prvega odstavka 8. člena in 9. člena, če je taka izjema določena v zakonu, spoštuje bistvo temeljnih pravic in svoboščin ter je nujen in sorazmeren ukrep v demokratični družbi za: a) zaščito varnosti države, obrambe, javne varnosti, pomembnih gospodarskih in finančnih interesov države, nepristranskosti in neodvisnosti sodstva ali preprečitev kaznivih dejanj, njihovo preiskovanje in pregon, izvrševanje kazenskih sankcij in za druge bistvene cilje v splošnem interesu; b) varstvo posameznika, na katerega se nanašajo osebni podatki, ali pravic in temeljnih svoboščin drugih, predvsem svobode izražanja. 2. Omejitve uresničevanja določb 8. in 9. člena so lahko predpisane z zakonom, in sicer v zvezi z obdelovanjem podatkov za arhiviranje v javnem interesu, za znanstvenoraziskovalne ali zgodovinskoraziskovalne ali statistične namene, če ni prepoznanega tveganja, da bi bile kršene pravice in temeljne svoboščine posameznikov, na katere se nanašajo osebni podatki. 3. Poleg izjem iz prvega odstavka tega člena lahko vsaka pogodbenica v zvezi z dejavnostmi obdelave podatkov za namene varnosti države in obrambe v zakonu določi izjeme glede tretjega odstavka 4. člena, petega in šestega odstavka 14. člena ter točk a), b), c) in d) drugega odstavka 15. člena, vendar le, če je ta izjema nujen in sorazmeren ukrep v demokratični družbi za uresničitev tega cilja. To ne posega v zahtevo, da je treba dejavnosti obdelave podatkov za namene varnosti države in obrambe neodvisno in učinkovito pregledovati in nadzirati v skladu z notranjo zakonodajo posamezne pogodbenice.«.

Besedilo 10. člena konvencije (novi 12. člen) se nadomesti z besedilom: »Vsaka pogodbenica se zavezuje k sprejetju primernih sodnih in drugih sankcij ter pravnih sredstev zoper kršitve določb konvencije.«.

Naslov III. poglavja se nadomesti z naslovom: »III. poglavje – čezmejni pretok osebnih podatkov«.

1 Naslov 12. člena konvencije (novi 14. člen) se nadomesti z naslovom: »14. člen – čezmejni pretok osebnih podatkov«. 2 Besedilo 12. člena konvencije (novi 14. člen) se nadomesti z besedilom: »1. Pogodbenica ne sme samo zaradi namena varstva osebnih podatkov prepovedati ali zahtevati posebnega dovoljenja za prenos osebnih podatkov uporabniku, ki je pod pristojnostjo druge pogodbenice konvencije. Lahko pa to stori, če obstaja dejansko in resno tveganje, da bi prenos drugi pogodbenici ali prenos od druge pogodbenice do nepogodbenice lahko vodil v izogibanje določbam konvencije. Pogodbenica lahko tako ravna tudi, če jo k temu zavezujejo usklajena pravila varstva držav članic regionalne mednarodne organizacije. 2. Če je uporabnik pod pristojnostjo države ali mednarodne organizacije, ki ni pogodbenica konvencije, se osebni podatki smejo prenesti samo, če je zagotovljena ustrezna raven varstva na podlagi določb konvencije. 3. Ustrezno raven varstva lahko zagotovijo: a) predpisi države ali mednarodne organizacije, tudi mednarodne pogodbe ali sporazumi, ki se uporabljajo, ali b) za določeni primer vzpostavljeni ali odobreni standardizirani zaščitni ukrepi iz pravno zavezujočih in izvršljivih aktov, ki jih sprejmejo in izvajajo osebe, vključene v prenos in nadaljnjo obdelavo. 4. Ne glede na določbe prejšnjih odstavkov lahko vsaka pogodbenica določi, da je osebne podatke mogoče prenesti, če: a) posameznik, na katerega se nanašajo osebni podatki, izrecno, konkretno in prostovoljno privoli v prenos, potem ko je obveščen o tveganjih zaradi neobstoječih ustreznih zaščitnih ukrepov, ali b) je v danem primeru to potrebno zaradi posebnih interesov posameznika, na katerega se nanašajo osebni podatki, ali c) so prevladujoči zakoniti interesi, predvsem pomembni javni interesi, določeni v zakonu in je prenos nujen in sorazmeren ukrep v demokratični družbi, ali d) je to nujen in sorazmeren ukrep v demokratični družbi v zvezi s svobodo izražanja. 5. Vsaka pogodbenica zagotovi, da pristojni nadzorni organ v smislu 15. člena konvencije dobi vse pomembne informacije o prenosih podatkov iz točke b) tretjega odstavka ter na zahtevo iz točk b) in c) četrtega odstavka. 6. Vsaka pogodbenica zagotovi, da ima nadzorni organ pravico od osebe, ki podatke prenaša, zahtevati dokaze o učinkovitosti zaščitnih ukrepov ali obstoju prevladujočih zakonitih interesov, nadzornemu organu pa zagotovi tudi možnost, da prepove in ustavi te prenose ali zanje določi pogoje in tako zaščiti pravice in temeljne svoboščine posameznikov, na katere se nanašajo osebni podatki.«. 3 Besedilo 12. člena konvencije (novi 14. člen) vključuje določbe 2. člena Dodatnega protokola iz leta 2001 glede nadzornih organov in čezmejnih pretokov podatkov (ETS št. 181) v zvezi s čezmejnimi pretoki osebnih podatkov uporabniku, ki ni pod pristojnostjo pogodbenice konvencije.

Za III. poglavjem konvencije se doda novo IV. poglavje: »IV. poglavje – nadzorni organi«.

Novi 15. člen vključuje določbe 1. člena Dodatnega protokola iz leta 2001 (ETS št. 181) in se glasi: 1. Vsaka pogodbenica določi organ, odgovoren za zagotavljanje skladnosti z določbami konvencije, ali več takih organov. 2. Ti organi, v ta namen: a) so pristojni za preiskovanje in ukrepanje; b) opravljajo naloge v zvezi s prenosi podatkov iz 14. člena, predvsem potrjujejo standardizirane zaščitne ukrepe; c) so pristojni za odločanje v zvezi s kršitvami določb konvencije, predvsem za izrekanje upravnih sankcij; d) so pristojni za sodelovanje v pravnih postopkih ali za predložitev kršitev določb konvencije pristojnim sodnim organom; e) spodbujajo: i. ozaveščanje javnosti o svojih nalogah, pristojnostih in dejavnostih; ii. ozaveščanje javnosti o pravicah posameznikov, na katere se nanašajo osebni podatki, in o uresničevanju teh pravic; iii. ozaveščanje upravljavcev in obdelovalcev o odgovornostih, ki jih imajo po konvenciji, pri čemer se posebna pozornost namenja pravici do varstva osebnih podatkov otrok in drugih ranljivih posameznikov. 3. S pristojnimi nadzornimi organi se je treba posvetovati o predlogih katerih koli zakonskih ali upravnih ukrepov, ki določajo obdelavo osebnih podatkov. 4. Vsak pristojni nadzorni organ obravnava zahteve in pritožbe, ki jih vložijo posamezniki, na katere se nanašajo osebni podatki, glede pravic s področja varstva osebnih podatkov in jih obvešča o napredku. 5. Pristojni organi so pri opravljanju dolžnosti in izvajanju pristojnosti polno neodvisni in nepristranski, pri čemer ne smejo niti zahtevati niti sprejemati nobenih navodil. 6. Vsaka pogodbenica zagotovi, da imajo nadzorni organi na voljo potrebna sredstva za učinkovito opravljanje nalog in izvajanje pristojnosti. 7. Vsak nadzorni organ pripravi redno poročilo o svojih dejavnostih in ga objavi. 8. Člani nadzornih organov in njihovo osebje so zavezani spoštovati obveznosti glede zaupnosti zaupnih informacij, do katerih imajo ali so imeli dostop pri opravljanju nalog in izvajanju pristojnosti. 9. Zoper odločitve nadzornih organov se je dopustno pritožiti pred sodiščem. 10. Nadzorni organi niso pristojni v zvezi z obdelavo podatkov, ki jo izvajajo organi, ki delujejo kot sodni organ.«.

1 IV. do VII. poglavje konvencije se preštevilčijo v V. do VIII. poglavje konvencije. 2 Naslov V. poglavja se nadomesti z naslovom: »V. poglavje – sodelovanje in medsebojna pomoč«. 3 Doda se nov 17. člen, dosedanji 13. do 27. člen konvencije pa postanejo 16. do 31. člen konvencije.

1 Naslov 13. člena konvencije (novi 16. člen) se nadomesti z naslovom: »16. člen – določitev nadzornih organov«. 2 Prvi odstavek 13. člena konvencije (novi 16. člen) se nadomesti z besedilom: »1. Pogodbenice soglašajo, da bodo sodelovale in si medsebojno pomagale pri izvajanju konvencije.«. 3 Drugi odstavek 13. člena konvencije (novi 16. člen) se nadomesti z besedilom: »2. V ta namen: a) vsaka pogodbenica določi nadzorni organ v smislu 15. člena konvencije ali več takih organov ter njihova imena in naslove sporoči generalnemu sekretarju Sveta Evrope; b) vsaka pogodbenica, ki določi več kot en nadzorni organ, v sporočilu iz prejšnje točke navede pristojnosti vsakega od njih.«. 4 Tretji odstavek 13. člena konvencije (novi 16. člen) se črta.

Za novim 16. členom konvencije se doda nov 17. člen: 1. Nadzorni organi sodelujejo drug z drugim v obsegu, potrebnem za opravljanje nalog in izvajanje pristojnosti, predvsem z: a) zagotavljanjem medsebojne pomoči z izmenjavo pomembnih in koristnih informacij ter medsebojnim sodelovanjem pod pogojem, da se v zvezi z varstvom osebnih podatkov upoštevajo vsa pravila in zaščitni ukrepi iz konvencije; b) usklajevanjem preiskav ali posegov ali izvajanjem skupnih ukrepov; c) zagotavljanjem informacij in dokumentacije o zakonodaji in upravni praksi v zvezi z varstvom podatkov. 2. Informacije iz prvega odstavka ne vključujejo osebnih podatkov, ki se obdelujejo, razen če so bistveni za sodelovanje ali če je posameznik, na katerega se nanašajo osebni podatki, izrecno, konkretno, prostovoljno in informirano privolil v njihovo pošiljanje. 3. Nadzorni organi pogodbenic oblikujejo mrežo za vzpostavitev sodelovanja in opravljanje nalog iz prejšnjih odstavkov.«.

1 Naslov 14. člena konvencije (novi 18. člen) se nadomesti z naslovom: »18. člen – pomoč posameznikom, na katere se nanašajo osebni podatki«. 2 Besedilo 14. člena konvencije (novi 18. člen) se nadomesti z besedilom: »1. Pri uresničevanju pravic iz 9. člena konvencije vsaka pogodbenica pomaga vsem posameznikom, na katere se nanašajo osebni podatki, ne glede na državljanstvo ali prebivališče. 2. Če posameznik, na katerega se nanašajo osebni podatki, prebiva na ozemlju druge pogodbenice, mu je treba omogočiti predložitev zahteve po nadzornem organu, ki ga določi ta pogodbenica. 3. Zahteva za pomoč vsebuje vse potrebne podatke, med drugim tudi: a) ime, naslov in druge podatke, pomembne za identifikacijo posameznika, ki vlaga zahtevo in na katerega se nanašajo osebni podatki; b) v zvezi z obdelavo podatkov, na katero se zahteva nanaša, ali njenim upravljavcem; c) namen zahteve.«.

1 Naslov 15. člena konvencije (novi 19. člen) se nadomesti z naslovom: »19. člen – zaščitni ukrepi«. 2 Besedilo 15. člena konvencije (novi 19. člen) se nadomesti z besedilom: »1. Nadzorni organ, ki v okviru zahteve ali odgovora na svojo zahtevo prejme informacije od drugega nadzornega organa, sme te informacije uporabiti samo za namene, določene v zahtevi. 2. Nadzorni organ na lastno pobudo in brez izrecnega soglasja posameznika, na katerega se nanašajo osebni podatki, nikakor ne sme vložiti zahteve v njegovem imenu.«.

1 Naslov 16. člena konvencije (novi 20. člen) se nadomesti z naslovom: »20. člen – zavrnitev zahtev«. 2 Uvodna poved 16. člena konvencije (novi 20. člen) se nadomesti z besedilom: »Nadzorni organ, na katerega je naslovljena zahteva iz 17. člena konvencije, zahteve ne more avrniti, razen če:«. 3 Točka a) 16. člena konvencije (novi 20. člen) se nadomesti z besedilom: »a) zahteva ni združljiva z njegovimi pristojnostmi;«. 4 Točka c) 16. člena konvencije (novi 20. člen) se nadomesti z besedilom: »c) bi bila izpolnitev zahteve v nasprotju s suverenostjo, varnostjo države ali javnim redom pogodbenice, ki je nadzorni organ določila, ali pa v nasprotju s pravicami in temeljnimi svoboščinami posameznikov, ki so pod njeno pristojnostjo.«.

1 Naslov 17. člena konvencije (novi 21. člen) se nadomesti z naslovom: »21. člen – stroški in postopki«. 2 Prvi odstavek 17. člena konvencije (novi 21. člen) se nadomesti z besedilom: »1. Za sodelovanje in medsebojno pomoč pogodbenic na podlagi 17. člena in za pomoč posameznikom, na katere se nanašajo osebni podatki, na podlagi 9. in 18. člena ni treba plačati nobenih stroškov ali pristojbin, razen za izvedence in tolmače. Te stroške ali pristojbine krije pogodbenica, ki za pomoč zaprosi.«. 3 Izraz »katerih« v drugem odstavku 17. člena konvencije (novi 21. člen) se nadomesti z izrazom »katerih«.

Naslov V. poglavja konvencije (novo VI. poglavje) se nadomesti z naslovom: »VI. poglavje – odbor konvencije«.

1 Izraz »posvetovalni odbor« v prvem odstavku 18. člena konvencije (novi 22. člen) se nadomesti z izrazom »odbor konvencije«. 2 Tretji odstavek 18. člena konvencije (novi 22. člen) se nadomesti z besedilom: »3. Odbor konvencije lahko z dvotretjinsko večino glasov predstavnikov pogodbenic odloči, da na sestanke povabi opazovalca.«. 3 Za tretjim odstavkom 18. člena konvencije (novi 22. člen) se doda nov četrti odstavek: »4. Vsaka pogodbenica, ki ni članica Sveta Evrope, prispeva k financiranju dela odbora konvencije na način, ki ga v dogovoru z njo določi Odbor ministrov.«.

1 Izraz »Posvetovalni odbor« v uvodni povedi 19. člena konvencije (novi 23. člen) se nadomesti z izrazom »Odbor konvencije«. 2 Izraz »predloge« iz točke a) 19. člena konvencije (novi 23. člen) se nadomesti z izrazom »priporočila«. 3 Sklica na »21. člen« v točki b) in »tretji odstavek 21. člena« v točki c) 19. člena konvencije (novi 23. člen) se nadomestita s sklicema na »25. člen« in »tretji odstavek 25. člena«. 4 Točka d) 19. člena konvencije (novi 23. člen) se nadomesti z besedilom: »d) lahko da mnenje o vprašanjih glede razlage ali uporabe konvencije,«. 5 Za točko d) 19. člena konvencije (novi 23. člen) se dodajo nove točke: »e) pred pristopom nove pogodbenice h konvenciji za Odbor ministrov pripravi mnenje o ravni varstva osebnih podatkov kandidatke za pristop, in kadar je to potrebno, priporoči sprejetje ukrepov za dosego skladnosti z določbami konvencije; f) na zahtevo države ali mednarodne organizacije lahko oceni, ali je raven varstva osebnih podatkov v tej državi v skladu z določbami konvencije, in kadar je to potrebno, priporoči sprejetje ukrepov za dosego skladnosti; g) lahko razvije ali odobri vzorce standardiziranih zaščitnih ukrepov iz 14. člena; h) pregleda, kako pogodbenice izvajajo konvencijo, in priporoči sprejetje ukrepov, če pogodbenica ne upošteva konvencije; i) omogoči, kadar je to potrebno, prijateljsko reševanje vseh težav v zvezi z uporabo konvencije.«.

Besedilo 20. člena konvencije (novi 24. člen) se nadomesti z besedilom: »1. Odbor konvencije skliče generalni sekretar Sveta Evrope. Prvo zasedanje se skliče v dvanajstih mesecih po začetku veljavnosti konvencije. Nato se odbor sestaja vsaj enkrat letno in v vsakem primeru, ko njegov sklic zahteva ena tretjina predstavnikov pogodbenic. 2. Odbor konvencije po vsakem zasedanju poroča Odboru ministrov Sveta Evrope o svojem delu in delovanju konvencije. 3. Ureditev glasovanja odbora konvencije je določena v delih poslovnika, priloženega k Protokolu CETS št. 223. 4. Odbor konvencije pripravi druge dele svojega poslovnika in na podlagi nepristranskih meril določi predvsem postopke za ocenjevanje in pregled iz tretjega odstavka 4. člena in točk e), f) in h) 23. člena.«.

1 Besedilo prvega do četrtega odstavka 21. člena konvencije (novi 25. člen) se nadomesti z besedilom: »1. Spremembe konvencije lahko predlaga pogodbenica, Odbor ministrov Sveta Evrope ali odbor konvencije. 2. Generalni sekretar Sveta Evrope o vsakem predlogu za spremembo obvesti pogodbenice konvencije, druge države članice Sveta Evrope, Evropsko unijo in vsako državo nečlanico ali mednarodno organizacijo, povabljeno, da pristopi h konvenciji v skladu z določbami 27. člena. 3. Prav tako se z vsako spremembo, ki jo predlaga pogodbenica ali Odbor ministrov, seznani odbor konvencije, ki Odboru ministrov predloži mnenje o predlagani spremembi. 4. Predlagano spremembo in mnenje odbora konvencije obravnava Odbor ministrov, ki spremembo lahko odobri.«. 2 Za šestim odstavkom 21. člena konvencije (novi 25. člen) se doda nov sedmi odstavek: »7. Odbor ministrov lahko po posvetovanju z odborom konvencije soglasno odloči, da začne posamezna sprememba veljati tri leta po dnevu, ko je bila dana na voljo za sprejetje, razen če pogodbenica uradno obvesti generalnega sekretarja Sveta Evrope, da ugovarja začetku njene veljavnosti. Če je poslano uradno obvestilo o ugovoru, začne sprememba veljati prvi dan meseca po dnevu, ko pogodbenica konvencije, ki je poslala uradno obvestilo o ugovoru, deponira svojo listino o sprejetju pri generalnem sekretarju Sveta Evrope.«.

1 Prvi odstavek 22. člena konvencije (novi 26. člen) se nadomesti z besedilom: »1. Konvencija je na voljo za podpis državam članicam Sveta Evrope in Evropski uniji. Konvencijo je treba ratificirati, sprejeti ali odobriti. Listine o ratifikaciji, sprejetju ali odobritvi se deponirajo pri generalnem sekretarju Sveta Evrope.«. 2 Izraz »državo članico« v tretjem odstavku 22. člena konvencije (novi 26. člen) se nadomesti z izrazom »pogodbenico«.

Naslov in besedilo 23. člena konvencije (novi 27. člen) se nadomestita z besedilom: 1. Po posvetovanju s pogodbenicami konvencije in z njihovim soglasjem ter glede na mnenje odbora konvencije, pripravljeno v skladu s točko e) 23. člena, lahko Odbor ministrov Sveta Evrope po začetku veljavnosti konvencije katero koli državo, ki ni članica Sveta Evrope, ali mednarodno organizacijo povabi, da pristopi h konvenciji, in sicer z odločitvijo, sprejeto z večino glasov iz točke d) 20. člena statuta Sveta Evrope in s soglasjem predstavnikov držav pogodbenic, ki imajo pravico zasedati v Odboru ministrov. 2. Za vsako državo ali mednarodno organizacijo, ki pristopi h konvenciji v skladu s prvim odstavkom zgoraj, začne konvencija veljati prvi dan meseca po poteku treh mesecev po dnevu deponiranja listine o pristopu pri generalnem sekretarju Sveta Evrope.«.

Besedilo prvega in drugega odstavka 24. člena konvencije (novi 28. člen) se nadomesti z besedilom: »1. Katera koli država, Evropska unija ali druga mednarodna organizacija lahko ob podpisu ali deponiranju listine o ratifikaciji, sprejetju, odobritvi ali pristopu določi ozemlje ali ozemlja, za katero ali katera se ta konvencija uporablja. 2. Katera koli država, Evropska unija ali druga mednarodna organizacija lahko kadar koli pozneje z izjavo, naslovljeno na generalnega sekretarja Sveta Evrope, razširi uporabo konvencije na katero koli drugo ozemlje, določeno v izjavi. Za to ozemlje začne konvencija veljati prvi dan meseca po poteku treh mesecev po dnevu, ko je generalni sekretar prejel izjavo.«.

1 Izraz »država« v uvodni povedi 27. člena konvencije (novi 31. člen) se nadomesti z izrazom »pogodbenica«. 2 Sklicevanje na »22., 23. in 24. člen« v točki c) se nadomesti s sklicevanjem na »26., 27. in 28. člen«. 1 Ta protokol je na voljo za podpis državam pogodbenicam konvencije. Protokol se ratificira, sprejme ali odobri. Listine o ratifikaciji, sprejetju ali odobritvi se deponirajo pri generalnem sekretarju Sveta Evrope 2 Po odprtju protokola za podpis in pred začetkom njegove veljavnosti lahko katera koli druga država izrazi soglasje, da jo protokol zavezuje s pristopom. Pogodbenica konvencije ne more postati, če hkrati ne pristopi k protokolu. 1 Ta protokol začne veljati prvi dan meseca po poteku treh mesecev po dnevu, ko so v skladu z določbami prvega odstavka 36. člena vse pogodbenice konvencije izrazile soglasje, da jih protokol zavezuje. 2 Če protokol ne začne veljati po petih letih po dnevu, ko je dan na voljo za podpis, kakor določa prvi odstavek, začne veljati v skladu s prvim odstavkom za tiste države, ki so izrazile soglasje, da jih protokol zavezuje, pod pogojem, da ima vsaj osemintrideset pogodbenic. Vse določbe spremenjene konvencije začnejo med pogodbenicami protokola učinkovati takoj po začetku veljavnosti. 3 Do začetka veljavnosti tega protokola in ne glede na določbe o začetku veljavnosti in pristopu držav nečlanic ali mednarodnih organizacij lahko pogodbenica konvencije ob podpisu tega protokola ali kadar koli pozneje izjavi, da bo začasno uporabljala njegove določbe. V tem primeru se določbe tega protokola uporabljajo le za pogodbenice konvencije, ki so dale izjavo z enakim učinkom. Izjava začne veljati prvi dan tretjega meseca po dnevu, ko jo prejme generalni sekretar Sveta Evrope. 4 Z dnem začetka veljavnosti tega protokola preneha veljati Dodatni protokol h Konvenciji o varstvu posameznikov glede na avtomatsko obdelavo osebnih podatkov v zvezi z nadzornimi organi in čezmejnim pretokom podatkov (ETS št. 181). 5 Z dnem začetka veljavnosti tega protokola spremembe Konvencije o varstvu posameznikov glede na avtomatsko obdelavo osebnih podatkov, ki jih je odobril Odbor ministrov v Strasbourgu 15. junija 1999, izgubijo svoj namen. Izjava ali več izjav, ki jih je pogodbenica dala v skladu s 3. členom konvencije, zanjo prenehajo veljati z dnem začetka veljavnosti tega protokola. Pridržki glede določb tega protokola niso dopustni. Generalni sekretar Sveta Evrope uradno obvesti države članice Sveta Evrope in vse pogodbenice konvencije o: a) vsakem podpisu; b) deponiranju vsake listine o ratifikaciji, sprejetju, odobritvi ali pristopu; c) dnevu začetka veljavnosti tega protokola v skladu s 37. členom; d) vsakem drugem dokumentu, uradnem obvestilu ali sporočilu v zvezi s protokolom. V potrditev tega so podpisani, ki so bili za to pravilno pooblaščeni, podpisali ta protokol. Sestavljeno v Strasbourgu 10. oktobra 2018 v angleškem in francoskem jeziku, pri čemer sta besedili enako verodostojni, v enem izvodu, ki se hrani v arhivu Sveta Evrope. Generalni sekretar Sveta Evrope pošlje overjene kopije vsaki državi članici Sveta Evrope, drugim pogodbenicam konvencije in vsaki državi, povabljeni, da pristopi h konvenciji. Priloga k protokolu: Sestavni deli za poslovnik odbora konvencije 1 Vsaka pogodbenica ima pravico do glasovanja in ima en glas. 2 Zasedanje odbora konvencije je sklepčno, če je na njem dve tretjini predstavnikov pogodbenic. Če v skladu z drugim odstavkom 37. člena spremenjeni protokol h konvenciji začne veljati pred začetkom veljavnosti v vseh državah pogodbenicah konvencije, so zasedanja odbora konvencije sklepčna, če je navzočih vsaj 34 pogodbenic protokola. 3 Odločitve iz 23. člena se sprejemajo s štiripetinsko večino glasov. Odločitve iz točke h) 23. člena se sprejemajo s štiripetinsko večino, vključno z večino glasov držav pogodbenic, ki niso članice organizacije za regionalno povezovanje, ki je pogodbenica konvencije. 4 Kadar odbor konvencije sprejema odločitve iz točke h) 23. člena, pogodbenica, na katero se nanaša pregled, ne glasuje. Če se odločitev nanaša na zadevo v pristojnosti organizacije za regionalno povezovanje, ne glasujejo ne organizacija ne njene države članice. 5 Odločitve o postopkovnih zadevah se sprejemajo z navadno večino glasov. 6 Organizacije za regionalno povezovanje lahko v zadevah v svoji pristojnosti v odboru konvencije uveljavijo svojo pravico do glasovanja s številom glasov, enakim številu njihovih držav članic, ki so pogodbenice konvencije. Organizacija ne uveljavi pravice do glasovanja, če jo uveljavi katera koli njena država članica. 7 V primeru glasovanja je treba vse pogodbenice obvestiti o predmetu in času glasovanja, pa tudi o tem, ali pravico do glasovanja uveljavi pogodbenica sama ali jo v imenu držav članic uveljavi organizacija za regionalno povezovanje. 8 Odbor konvencije lahko z dvotretjinsko večino glasov spremeni svoj poslovnik, razen ureditve glasovanja, ki jo pogodbenice lahko spremenijo le soglasno in za katero se uporablja 25. člen konvencije.«

Za izvajanje protokola skrbi ministrstvo, pristojno za pravosodje, za zagotavljanje skladnosti z določbami konvencije pa Informacijski pooblaščenec, določen z zakonom, ki ureja informacijskega pooblaščenca, kot samostojen in neodvisen državni nadzorni organ za varstvo osebnih podatkov.

Ta zakon začne veljati petnajsti dan po objavi v Uradnem listu Republike Slovenije – Mednarodne pogodbe. Št. 040-05/19-12/14 Ljubljana, dne 23. maja 2023 EPA 532-VIII Državni zbor Republike Slovenije Nataša Sukič podpredsednica