The issue of national sovereignty
Whenever proposals are made to get countries to agree to a universal approach to a situation, such as recent EU proposals for a fiscal union to address the eurozone debt crisis, there is always the potential for the unified system to take over and replace national laws, so much so that it could become a threat to national sovereignty.
We asked Kwasny if this was a possibility with the Council's proposals, but she said that this was more of a European Union concern, as the convention is a matter of international law, which only has power over the countries that agree to it and not over individuals or private firms like the EU has.
However, she agreed that the convention would have to abide by EU regulations, including a recently proposed change to EU law which will see Member States following a unified data protection policy where a company is only answerable to the laws and data protection authority of the country it primarily resides in, compared to the current system where companies are required to abide by multiple, often disparate laws.
This EU plan could cause significant difficulties for the Council of Europe's proposal, as the EU process will likely take a number of years and the Council is bound to conformity with EU regulations. This means that if the updated convention contains policies that in any way clash with what the EU will eventually decide on, the Council will have to return to the drawing table. However, Kwasny said that the general provisions sought in the convention would be unlikely to be contradictory to the EU proposals.
This general approach does not mean that countries can ignore proper data protection protocols, however.
“They are bound by the provisions of the convention, but that's the minimum requirement. They need to be in conformity with that,” Kwasny told us. She added that each country can go further, as the EU has done with its approach to data protection for the 27 Member States.
The problem for the Council is that it cannot enforce any of this. There will not be any sanctions in place for those who break the rules, except for those given by national data protection authorities, though there are plans for a follow-up system to ensure that countries are abiding by the convention. This means that while close to 50 countries will likely be signing up to the agreement, they will each get to enforce it in their own way, a fact that will please those afraid of losing national sovereignty. At least, of course, until the European Union implements its own proposals.