Following the decision of the European Court of Justice in the Schrems II case (C-311/18), it is becoming increasingly clear that the content of this ruling by no means only affects data transfers to the USA. In the absence of an adequacy finding by the European Commission, the ECJ requires data exporters to assess whether an equivalent level of protection for personal data exists in the respective third country prior to the transfer.

The question arises as to what significance Convention No. 108 and No. 108+ (one speaks of „No. 108+“ since the old Convention was adapted in 2018) of the Council of Europe for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention No. 108) plays in the examination of the level of protection in third countries that are party to this international agreement. My colleague Philipp Quiel and I have considered this issue in greater depth and compared the requirements of the GDPR for an „equivalent level of protection“ with the provisions of Convention No. 108+. The article can be downloaded here (PDF).