The Automated Means Criterion is a key factor in determining the applicability of Convention 108, focusing on the automatic processing of personal data.

Text of Relevant Provisions

108 Convention Art.1:

"The purpose of this convention is to secure in the territory of each Party for every individual, whatever his nationality or residence, respect for his rights and fundamental freedoms, and in particular his right to privacy, with regard to automatic processing of personal data relating to him ("data protection")."

108 Convention Art.2(b):

"For the purposes of this convention: "automated data file" means any set of data undergoing automatic processing;"

108 Convention Art.2(c):

"For the purposes of this convention: "automatic processing" includes the following operations if carried out in whole or in part by automated means: storage of data, carrying out of logical and/or arithmetical operations on those data, their alteration, erasure, retrieval or dissemination;"

108 Convention Art.3(1):

"The Parties undertake to apply this convention to automated personal data files and automatic processing of personal data in the public and private sectors."

Analysis of Provisions

Convention 108 explicitly incorporates the Automated Means Criterion as a key factor in determining its applicability. The convention's scope is primarily focused on the "automatic processing of personal data", as stated in Article 1. This emphasis on automated processing is further reinforced in subsequent articles.

Article 2(b) defines "automated data file" as "any set of data undergoing automatic processing", while Article 2(c) provides a comprehensive definition of "automatic processing". This definition encompasses a wide range of operations, including "storage of data, carrying out of logical and/or arithmetical operations on those data, their alteration, erasure, retrieval or dissemination", as long as these operations are "carried out in whole or in part by automated means".

The inclusion of the phrase "in whole or in part" is particularly significant, as it extends the convention's applicability to processes that may involve a combination of automated and manual operations. This broad interpretation ensures that the convention covers a wide range of data processing activities, reflecting the diverse ways in which personal data can be handled in modern technological contexts.

Article 3(1) further solidifies the centrality of the Automated Means Criterion by explicitly stating that the convention applies to "automated personal data files and automatic processing of personal data" in both public and private sectors. This comprehensive coverage ensures that the convention's protections extend across various domains where personal data is processed automatically.

Implications

The Automated Means Criterion has significant implications for businesses and organizations handling personal data:

1. Broad applicability: The convention's focus on automated processing means that it applies to a wide range of technological systems and processes used for handling personal data. This includes databases, digital communication systems, and any software that processes personal information.
2. Partial automation: Even processes that are only partially automated fall within the convention's scope. This means that businesses must consider the convention's requirements even when some aspects of their data processing are manual.
3. Technological neutrality: The broad definition of automatic processing allows the convention to remain relevant as technology evolves, covering both current and future forms of automated data handling.
4. Public and private sector coverage: The convention's applicability to both public and private sectors ensures consistent data protection standards across different types of organizations.
5. Data protection measures: Organizations must implement appropriate technical and organizational measures to ensure the security and privacy of personal data processed through automated means.
6. Compliance considerations: Businesses operating in countries that have ratified Convention 108 must ensure that their automated data processing activities comply with the convention's principles and requirements.