Global Jurisdiction: Filing System Criterion

The "Filing System Criterion" is not directly present in the provisions of the Convention 108 as analyzed. The provisions provided do not explicitly address the application of the law to manual processing of personal data that is structured or organized in a way that allows for easy retrieval or access. The focus of Convention 108 is on the automatic processing of personal data, with an optional extension for non-automated personal data files, but it does not clearly introduce a "Filing System Criterion" as a determinant for the scope of applicability.

Text of Relevant Provisions

108 Convention Art.3(2)(c):

"Any State may, at the time of signature or when depositing its instrument of ratification, acceptance, approval or accession, or at any later time, give notice by a declaration addressed to the Secretary General of the Council of Europe: (c) that it will also apply this convention to personal data files which are not processed automatically."

Analysis of Provisions

• Convention 108 Article 3(2)(c) allows a state to extend the application of the Convention to "personal data files which are not processed automatically." This extension is not automatic and requires a formal declaration by the state.
• The provision does not elaborate on the nature of non-automated data processing, nor does it explicitly mention a filing system criterion based on the structure or retrievability of the data. Instead, it leaves the decision to apply the Convention to such files to the discretion of individual states.
• The lack of mention of a "Filing System Criterion" suggests that the provision does not inherently consider the organization or accessibility of manually processed data as a factor for the applicability of data protection rules. The focus remains on whether the data is processed automatically or not.
• In jurisdictions that adopt this provision, the applicability of data protection law to manual filing systems would depend entirely on whether the state has chosen to make such a declaration, rather than on the structure of the filing system itself.

Implications

• For businesses operating globally or across multiple jurisdictions, this means that the applicability of data protection laws to manually processed personal data may vary significantly depending on the specific declarations made by each state under Convention 108. Companies need to be aware of the specific declarations made by the states in which they operate to understand whether their manual data processing activities are subject to data protection laws.
• If a state has not made the relevant declaration, then manual filing systems, regardless of how systematically they are organized, would not be subject to the data protection obligations under Convention 108. This could lead to significant regulatory differences between automated and manual processing of personal data within the same jurisdiction.