Legal background Intelligence services processing
Convention 108 establishes a number of principles for states to transpose into their domestic legislation, these include the requirement to ensure that data is processed through procedures set out by law for a specific purpose, and data is stored no longer than is necessary for the intended purpose. An additional protocol requires each party to establish an independent authority to ensure compliance with data protection principles and lays down rules on trans-border data flows to non Parties.
	In keeping with the Convention’s philosophy, the provisions consist of general, simple and concise principles allowing signatories a certain measure of discretion when implementing them through national legislation.
	The main innovations in the modernised Convention 108 include:
	proportionality (formerly implicit);
	accountability, in particular of data controllers and processors;
	renewed focus on data security;
	additional obligations to declare data breaches
	enhanced transparency of data processing;
	additional safeguards for the data subject such as the right not to be subject to a decision solely based on an automatic processing without having his or her views taken into consideration, the right to obtain information about the logic underlying the processing, and the right to object.
	Article 9 of the modernised Convention 108 will continue to allow Parties to exempt controllers from some of these requirements for specified purposes. One such purpose is the protection of national security.