HumenhukCIPP/US Study Guide
Chapter 1: Introduction to Privacy

Council of Europe Convention 108 (1981)

Reviewed by Victor Humenhuk. Published . Reviewed .

Convention 108 (1981) required its parties to enact data protection provisions in domestic law. It was modernised through the 2018 protocol known as Convention 108+. The United States is not a party to either instrument.

How this supports CIPP/US study

Use this lesson to identify the legal source, actor, data and activity before applying a rule to a scenario. Continue with the CIPP/US exam format and blueprint.

Convention 108 (1981) required signatory Council of Europe member states to incorporate data protection provisions into domestic law. It addressed quality of data, special categories of data, data security, and transborder data flows, and was broadly similar to the OECD Guidelines.

In 2018, the Council of Europe adopted Convention 108+, aligning it with the GDPR (necessary/proportionate processing, breach notice, transborder requirements).

U.S. status

The United States has not ratified Convention 108 or Convention 108+. It is not a Council of Europe member and is not bound as a party to either instrument.

Key terms - quick answers

What is “Convention 108”?
The 1981 Council of Europe Convention for the Protection of Individuals with Regard to Automatic Processing of Personal Data, requiring signatory states to adopt data protection provisions in domestic law.
What is “Convention 108+”?
The 2018 update to Convention 108, bringing it in line with the EU's GDPR on proportionality, breach notice, and transborder flows.
What is “Special categories of data”?
Under Convention 108, sensitive data such as racial origin, political opinions, religious beliefs, health, sex life, or criminal convictions that cannot be automatically processed absent appropriate safeguards.

Sources and study method

This independent lesson uses active recall, spaced retrieval and scenario practice. Read the full study method.