Protocol amending the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data

Parties with reservations, declarations and objections

Party	Reservations / Declarations	Objections
Bulgaria	Yes	No
Cyprus	Yes	No
Estonia	Yes	No
Finland	Yes	No
France	Yes	No
Lithuania	Yes	No
Norway	Yes	No
Russian Federation	Yes	No
Spain	Yes	No

Bulgaria

10-10-2018

The Republic of Bulgaria will apply this Protocol on a provisional basis in accordance with Article 37, paragraph 3, thereof. Date of effect of the declaration 1 February 2019.

10-12-2019

The Republic of Bulgaria will apply this Protocol on a provisional basis in accordance with Article 37, paragraph 3, thereof.

Cyprus

21-09-2020

Pending the entry into force of the Protocol and action pursuant to Article 37, paragraph 3, of the Protocol, the Republic of Cyprus declares that it will apply this Protocol on a provisional basis.

Estonia

16-09-2020

In accordance with Article 37, paragraph 3, of the Protocol, the Republic of Estonia declares that it will apply the provisions of the Protocol on a provisional basis pending its entry into force.

Finland

10-12-2020

The Republic of Finland declares that, for the purpose of Article 3, paragraph 1, of the Convention, the processing of personal data in the public sector is interpreted as covering the processing by central government authorities, state, enterprises, municipal authorities, autonomous institutions governed by public law, agencies operating under Parliament or the Office of the President of the Republic, or the Evangelical Lutheran Church of Finland and the Orthodox Church of Finland or their parishes, parish unions and other bodies.

France

27-03-2023

Article 9 of this Amending Protocol (Article 7 of Convention 108 as revised by the Protocol) lays down a general principle of notification of data breaches which may seriously interfere with the rights and fundamental freedoms of the data subjects. With reference to this provision, and with regard to the implementation of processing operations whose purposes are the protection of national security, defense and public safety, the French Republic declares that the legislator, within the framework of Law no. 78-17 of 6 January 1978 relating to data processing, files and freedoms, modified, expressly intended to exclude any notification to the supervisory authority in the event of data breaches occurring in a processing operation involving national defense and security . This obligation, provided for in Titles II and III of this law, has in fact not been extended by the legislator to its Title IV relating to processing involving State security and defense. French positive law is therefore understood as constituting an exception within the meaning and for the application of Article 14 of this amending Protocol (Article 11 of Convention 108 as revised by the Protocol), which allows exceptions to this obligation of notification set out in Article 9 of the same Protocol, in particular when they are provided for by law, they respect the essence of the fundamental rights and freedoms and they constitute a necessary and proportionate measure in a democratic society.

Lithuania

23-01-2020

The Seimas of the Republic of Lithuania, acting pursuant to Article 21 of the Protocol, declares that the State Data Protection Inspectorate is designated as a supervisory authority and, where personal data are processed for journalistic purposes and for purposes of academic, artistic or literary self-expression, the Inspector of Journalistic Ethics is designated as a supervisory authority.
Pending the entry into force of the Protocol, the Seimas of the Republic of Lithuania, acting pursuant to Article 37 (3) of the Protocol, declares that the Republic of Lithuania will apply this Protocol on a provisional basis.

Norway

10-10-2018

In accordance with Article 37, paragraph 3, of the Protocol, Norway will apply the provisions of the Protocol on a provisional basis.
Date of effect of the declaration 1 February 2019.

Russian Federation

25-03-2022

Depositary communication.
Signatory considered to be suspended as from 16 March 2022.

Spain

28-01-2021

The Permanent Representation of the Kingdom of Spain has the honour to communicate that if the Protocol amending the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (CETS No. 223) were to be ratified by the United-Kingdom and extended to Gibraltar, Spain would like to make the following declaration:
1. Gibraltar is a non-autonomous territory whose international relations come under the responsibility of the United Kingdom and which is subject to a decolonisation process in accordance with the relevant decisions and resolutions of the General Assembly of the United Nations.
2. The authorities of Gibraltar have a local character and exercise exclusively internal competences which have their origin and their foundation in a distribution and attribution of competences performed by the United Kingdom in compliance with its internal legislation, in its capacity as sovereign State of which the mentioned non-autonomous territory is dependent.
3. As a result, any participation of the Gibraltarian authorities in the application of this Protocol will be understood as carried out exclusively as part of the internal competences of Gibraltar and cannot be considered to modify in any way what was established in the two previous paragraphs. 4. The procedure foreseen in the Arrangements relating to Gibraltar authorities in the context of certain international treaties which were adopted by Spain and the United Kingdom on 19 December 2007, as well as the "Agreed Arrangements relating to Gibraltar authorities in the context of EU and EC instruments and related treaties", dated 19 April 2000, apply to this Protocol. 5. The application of the Protocol to Gibraltar should not be interpreted as an acknowledgment of any right or any situation regarding areas not covered by Article X of the Treaty of Utrecht of 13 July 1713, concluded between the Crowns of Spain and of the United Kingdom.

28-04-2022

With regard to the communication that the United Kingdom addressed to the Secretariat General of the Council of Europe on 29 July 2019, concerning the intention of the United Kingdom to extend to Gibraltar the application of the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (ETS No. 108), and notification of which was received by letter from the Secretary General dated 12 July 2019, Spain, recalling that it is a Party to the said Convention, as well as to the Additional Protocol (ETS No. 181) and to Protocol of amendment (CETS No. 223) thereof, wishes to recall the content of its Declaration of 5 March 2008 and to make the following statement:
- Gibraltar is a non-autonomous territory whose international relations come under the responsibility of the United Kingdom and which is subject to a decolonisation process in accordance with the relevant decisions and resolutions of the General Assembly of the United Nations.
- The authorities of Gibraltar have a local character and exercise exclusively internal competences which have their origin and their foundation in a distribution and attribution of competences performed by the United Kingdom in compliance with its internal legislation, in its capacity as sovereign State of which the mentioned non-autonomous territory is dependent.
- As a result, any participation of the Gibraltarian authorities in the application of the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data will be understood as carried out exclusively as part of the internal competences of Gibraltar and cannot be considered to modify in any way what was established in the two previous paragraphs.
- The procedure foreseen in the Arrangements relating to Gibraltar authorities in the context of certain international treaties which were adopted by Spain and the United Kingdom on 19 December 2007 (as well as the Agreed Arrangements relating to Gibraltar authorities in the context of EU and EC instruments and related treaties, dated 19 April 2000), apply to this Convention and to the Protocols thereof.
- The application to Gibraltar of this Convention and of the Protocols thereof should not be interpreted as an acknowledgment of any right or any situation regarding areas not covered by Article X of the Treaty of Utrecht of 13 July 1713, concluded between the Crowns of Spain and of the United Kingdom.