Na podlagi druge alinee prvega odstavka 107. člena in prvega odstavka 91. člena ustave Republike Slovenije izdajam
UKAZ
o razglasitvi zakona o ratifikaciji konvencije o varstvu posameznikov glede na avtomatsko obdelavo podatkov
Razglašam zakon o ratifikaciji konvencije o varstvu posameznikov glede na avtomatsko obdelavo podatkov, ki ga je sprejel Državni zbor Republike Slovenije na seji dne 25. januarja 1994.
Št. 0100-11/94
Ljubljana, dne 3. februarja 1994.
Predsednik
Republike Slovenije
Milan Kučan l. r.
ZAKON
O RATIFIKACIJI KONVENCIJE O VARSTVU POSAMEZNIKOV GLEDE NA AVTOMATSKO OBDELAVO OSEBNIH PODATKOV
1. člen
Ratificira se konvencija o varstvu posameznikov glede na avtomatsko obdelavo osebnih podatkov, sprejeta 28. januarja 1981 v Strasbourgu.
2. člen
Konvencija se v izvirniku v angleškem jeziku in prevodu v slovenskem jeziku glasi:
CONVENTION
FOR THE PROTECTION OF INDIVIDUALS WITH AUTOMATIC PROCESSING OF PERSONAL DATA
PREAMBLE
The member States of the Council of Europe, signatory hereto,
Considering that the aim of the Council of Europe is to achieve greater unity between its members, based in particular on respect for the rule of law, as well as human rights and fundamental freedoms;
Considering that it is desirable to extend the safeguards for everyone's rights and fundamental freedoms, and in particular the right to the respect for privacy, taking account of the increasing flow across frontiers of personal data undergoing automatic processing;
Reaffirming at the same time their commitment to freedom of information regardless of frontiers;
Recognizing that it is necessary to reconcile the fundamental values of the respect for privacy and the free flow of information between peoples,
Have agreed as follows:
CHAPTER I – GENERAL PROVISIONS
Article 1
Object and purpose
The purpose of this convention is to secure in the territory of each Party for every individual, whatever his nationality or residence, respect for his rights and fundamental freedoms, and in particular his right to privacy, with regard to automatic processing of personal data relating to him ("data protection").
Article 2
Definitions
For the purposes of this convention:
a. "personal data" means any information relating to an identified or identifiable individual ("data subject");
b. "automated data file" means any set of data undergoing automatic processing;
c. "automatic processing" includes the following operations if carried out in whole or in part by automated means: storage of data, carrying out of logical and/or arithmetical operations on those data, their alteration, erasure, retrieval or dissemination;
d. "controller of the file" means the natural or legal person, public authority, agency or any other body who is competent according to the national law to decide what should be the purpose of the automated data file, which categories of personal data should be stored and which operations should be applied to them.
Article 3
Scope
1. The Parties undertake to apply this convention to automated personal data files and automatic processing of personal data in the public and private sectors.
2. Any State may, at the time of signature or when depositing its instrument of ratification, acceptance, approval or accession, or at any later time, give notice by a declaration addressed to the Secretary General of the Council of Europe:
a. that it will not apply this convention to certain categories of automated personal data files, a list of which will be deposited. In this list it shall not include, however, categories of automated data files subject under its domestic law to data protection provisions. Consequently, it shall amend this list by a new declaration whenever additional categories of automated personal data files are subjected to data protection provisions under its domestic law;
b. that it will also apply this convention to information relating to groups of persons, associations, foundations, companies, corporations and any other bodies consisting directly or indirectly of individuals, whether or not such bodies possess legal personality;
c. that it will also apply this convention to personal data files which are not processed automatically.
3. Any State which has extended the scope of this convention by any of the declarations provided for in sub-paragraph 2.b or c above may give notice in the said declaration that such extensions shall apply only to certain categories of personal data files, a list of which will be deposited.
4. Any Party which has excluded certain categories of automated personal data files by a declaration provided for in subparagraph 2.a above may not claim the application of this convention to such categories by a Party which has not excluded them.
5. Likewise, a Party which has not made one or other of the extensions provided for in sub-paragraphs 2. b and c above may not claim the application of this convention on these points with respect to a Party which has made such extensions.
6. The declarations provided for in paragraph 2 above shall take effect from the moment of the entry into force of the convention with regard to the State which has made them if they have been made at the time of signature or deposit of its instrument of ratification, acceptance, approval or accession, or three months after their receipt by the Secretary General of the Council of Europe if they have been made at any later time. These declarations may be withdrawn, in whole or in part, by a notification addressed to the Secretary General of the Council of Europe. Such withdrawals shall take effect three months after the date of receipt of such notification.
CHAPTER II – BASIC PRINCIPLES FOR DATA PROTECTION
Article 4
Duties of the Parties
1. Each Party shall take the necessary measures in its-domestic law to give effect to the basic principles for data protection set out in this chapter.
2. These measures shall be taken at the latest at the time of entry into force of this convention in respect of that Party.
Article 5
Quality of data
Personal data undergoing automatic processing shall be:
a. obtained and processed fairly and lawfully;
b. stored for specified and legitimate purposes and not used in a way incompatible with those purposes;
c. adequate, relevant and not excessive in relation to the purposes for which they are stored;
d. accurate and, where necessary, kept up to date;
e. preserved in a form which permits identification of the data subjects for no longer than is required for the purpose for which those data are stored.
Article 6
Special categories of data
Personal data revealing racial origin, political opinions or religious or other beliefs, as well as personal data concerning health or sexual life, may not be processed automatically unless domestic law provides appropriate safeguards. The same shall apply to personal data relating to criminal convictions.
Article 7
Data security
Appropriate security measures shall be taken for the protection of personal data stored in automated data files against accidental or unauthorized destruction or accidental loss as well as against unauthorized access, alteration or dissemination.
Article 8
Additional safeguards for the data subject
Any person shall be enabled:
a. to establish the existence of an automated personal data file, its main purposes, as well as the identity and habitual residence or principal place of business of the controller of the file;
b. to obtain at reasonable intervals and without excessive delay or expense confirmation of whether personal data relating to him are stored in the automated data file as well as communication to him of such data in an intelligible form;
c. to obtain, as the case may be, rectification or erasure of such data if these have been processed contrary to the provisions of domestic law giving effect to the basic principles set out in Articles 5 and 6 of this convention;
d. to have a remedy if a request for confirmation or, as the case may be, communication, rectification or erasure as referred to in paragraphs b and c of this article is not complied with.
Article 9
Exceptions and restrictions
1. No exception to the provisions of Articles 5, 6 and 8 of this convention shall be allowed except within the limits defined in this article.
2. Derogation from the provisions of Articles 5, 6 and 8 of this convention shall be allowed when such derogation is provided for by the law of the Party and constitutes a necessary measure in a democratic society in the interests of:
a. protecting State security, public safety, the monetary interests of the State or the suppression of criminal offences;
b. protecting the data subject or the rights and freedoms of others.
3. Restrictions on the exercise of the rights specified in Article 8, paragraphs b, c and d, may be provided by law with respect to automated personal data files used for statistics or for scientific research purposes when there is obviously no risk of an infringement of the privacy of the data subjects.
Article 10
Sanctions and remedies
Each Party undertakes to establish appropriate sanctions and remedies for violations of provisions of domestic law giving effect to the basic principles for data protection set out in this chapter.
Article 11
Extended protection
None of the provisions of this chapter shall be interpreted as limiting or otherwise affecting the possibility for a Party to grant data subjects a wider measure of protection than that stipulated in this convention.
CHAPTER III – TRANSBORDER DATA FLOWS
Article 12
Transborder flows of personal data and domestic law
1. The following provisions shall apply to the transfer across national borders, by whatever medium, of personal data undergoing automatic processing or collected with a view to their being automatically processed.
2. A Party shall not, for the sole purpose of the protection of privacy, prohibit or subject to special authorization transborder flows of personal data going to the territory of another Party.
3. Nevertheless, each Party shall be entitled to derogate from the provisions of paragraph 2:
a. insofar as its legislation includes specific regulations for certain categories of personal data or of automated personal data files, because of the nature of those data or those files, except where the regulations of the other Party provide an equivalent protection
b. when the transfer is made from its territory to the territory of a non-Contracting State through the intermediary of the territory of another Party, in order to avoid such transfers resulting in circumvention of the legislation of the Party referred to at the beginning of this paragraph.
CHAPTER IV – MUTUAL ASSISTANCE
Article 13
Co-operation between Parties
1. The Parties agree to render each other mutual assistance in order to implement this convention.
2. For that purpose:
a. each Party shall designate one or more authorities, the name and address of each of which it shall communicate to the Secretary General of the Council of Europe;
b. each Party which has designated more than one authority shall specify in its communication referred to in the previous sub-paragraph the competence of each authority.
3. An authority designated by a Party shall at the request of an authority designated by another Party:
a. furnish information on its law and administrative practice in the field of data protection;
b. take, in conformity with its domestic law and for the sole purpose of protection of privacy, all appropriate measures for furnishing factual information relating to specific automatic processing carried out in its territory, with the exception however of the personal data being processed.
Article 14 Assistance to data subjects resident abroad
1. Each Party shall assist any person resident abroad to exercise the rights conferred by its domestic law giving effect to the principles set out in Article 8 of this convention.
2. When such a person resides in the territory of another Party he shall be given the option of submitting his request through the intermediary of the authority designated by that Party.
3. The request for assistance shall contain all the necessary particulars, relating inter alia to:
a. the name, address and any other relevant particulars identifying the person making the request;
b. the automated personal data file to which the request pertains, or its controller;
c. the purpose of the request.
Article 15
Safeguards concerning assistance rendered by
designated authorities
1. An authority designated by a Party which has received information from an authority designated by another Party either accompanying a request for assistance or in reply to its own request for assistance shall not use that information for purposes other than those specified in the request for assistance.
2. Each Party shall see to it that the persons belonging to or acting on behalf of the designated authority shall be bound by appropriate obligations of secrecy or confidentiality with regard to that information.
3. In no case may a designated authority be allowed to make under Article 14, paragraph 2, a request for assistance on behalf of a data subject resident abroad, of its own accord and without the express consent of the person concerned.
Article 16
Refusal of requests for assistance
A designated authority to which a request for assistance is addressed under Articles 13 or 14 of this convention may not refuse to comply with it unless:
a. the request is not compatible with the powers in the field of data protection of the authorities responsible for replying;
b. the request does not comply with the provisions of this convention;
c. compliance with the request would be incompatible with the sovereignty, security or public policy (ordre public) of the Party by which it was designated, or with the rights and fundamental freedoms of persons under the jurisdiction of that Party.
Article 17
Costs and procedures of assistance.
1. Mutual assistance which the Parties render each other under Article 13 and assistance they render to data subjects abroad under Article 14 shall not give rise to the payment of any costs or fees other than those incurred for experts and interpreters. The latter costs or fees shall be borne by the Party which has designated the authority making the request for assistance.
2. The data subject may not be charged costs or fees in connection with the steps taken on his behalf in the territory of another Party other than those lawfully payable by residents of that Party.
3. Other details concerning the assistance relating in particular to the forms and procedures and the languages to be used, shall be established directly between the Parties concerned.
CHAPTER V- CONSULTATIVE COMMITTEE
Article 18
Composition of the committee
LA Consultative Committee shall be set up after the entry into force of this convention.
2. Each Party shall appoint a representative to the committee and a deputy representative. Any member State of the Council of Europe which is not a Party to the convention shall have the right to be represented on the committee by an observer.
3. The Consultative Committee may, by unanimous decision, invite any non-member State of the Council of Europe which is not a Party to the convention to be represented by an observer at a given meeting.
Article 19
Functions of the committee
The Consultative Committee:
a. may make proposals with a view to facilitating or improving the application of the convention;
b. may make proposals for amendment of this convention in accordance with Article 21;
c. shall formulate its opinion on any proposal for amendment of this convention which is referred to it in accordance with Article 21, paragraph 3;
d. may, at the request of a Party, express an opinion on any question concerning the application of this convention.
Article 20
Procedure
1. The Consultative Committee shall be convened by the Secretary General of the Council of Europe. Its first meeting shall be held within twelve months of the entry into force of this convention. It shall subsequently meet at least once every two years and in any case when one-third of the representatives of the Parties request its convocation.
2. A majority of representatives of the Parties shall constitute a quorum for a meeting of the' Consultative Committee.
3. After each of its meetings, the Consultative Committee shall submit to the Committee of Ministers of the Council of Europe a report on its work and on the functioning of the convention.
4. Subject to the provisions of this convention, the Consultative Committee shall draw up its own Rules of Procedure.
CHAPTER VI – AMENDMENTS
Article 21
Amendments
1. Amendments to this convention may be proposed by a Party, the Committee of Ministers of the Council of Europe or the Consultative Committee.
2. Any proposal for amendment shall be communicated by the Secretary General of the Council of Europe to the member States of the Council of Europe and to every non-member Stale which has acceded to or has been invited to accede to this convention in accordance with the provisions of Article 23.
3. Moreover, any amendment proposed by a Party or the Committee of Ministers shall be communicated to the Consultative Committee, which shall submit to the Committee of Ministers its opinion on that proposed amendment.
4. The Committee of Ministers shall consider the proposed amendment and any opinion submitted by the Consultative Committee and may approve the amendment.
5. The text of any amendment approved by the Committee of Ministers in accordance with paragraph 4 of this article shall be forwarded to the Parties for acceptance.
6. Any amendment approved in accordance with paragraph 4 of this article shall come into force on the thirtieth day after all Parties have informed the Secretary General of their acceptance thereof.
CHAPTER VII – FINAL CLAUSES
Article 22
Entry into force
1. This convention shall be open for signature by the member States of the Council of Europe. It is subject to ratification, acceptance or approval. Instruments of ratification, acceptance or approval shall be deposited with the Secretary General of the Council of Europe.
2. This convention shall enter into force on the first day of the month following the expiration of a period of three months after the date on which five member States of the Council of Europe have expressed their consent to be bound by the convention in accordance with the provisions of the preceding paragraph.
3. In respect of any member State which subsequently expresses its consent to be bound by it, the convention shall enter into force on the first day of the month following the expiration of a period of three months after the date of the deposit of the instrument of ratification, acceptance or approval.
Article 23
Accession by non-member States
1. After the entry into force of this convention, the Committee of Ministers of the Council of Europe may invite any State not a member of the Council of Europe to accede to this convention by a decision taken by the majority provided for in Article 20.d of the Statute of the Council of Europe and by the unanimous vote of the representatives of the Contracting States entitled to sit on the committee.
2. In respect of any acceding State, the convention shall enter into force on the first day of the month following the expiration of a period of three months after the date of deposit of the instrument of accession with the Secretary General of the Council of Europe.
Article 24
Territorial clause
1. Any State may at the time of signature or when depositing its instrument of ratification, acceptance, approval or accession, specify the territory or territories to which this convention shall apply.
.2. Any State may at any later date, by a declaration addressed to the Secretary General of the Council of Europe, extend the application of this convention to any other territory specified in the declaration. In respect of such territory the convention shall enter into force on the first day of the month following the expiration of a period of three months after the date of receipt of such declaration by the Secretary General.
3. Any declaration made under the two preceding paragraphs may, in respect of any territory specified in such declaration, be withdrawn by a notification addressed to the Secretary General. The withdrawal shall become effective on the first day of the month following the expiration of a period of six months after the date of receipt of such notification by the Secretary General.
Article 25
Reservations
No reservation may be made in respect of the provisions of this convention.
Article 26
Denunciation
1. Any Party may at any time denounce this convention by means of a notification addressed to the Secretary General of the Council of Europe.
2. Such denunciation shall become effective on the first day of the month following the expiration of a period of six months after the date of receipt of the notification by the Secretary General.
Article 27
Notifications
The Secretary General of the Council of Europe shall notify the member States of the Council and any State which has acceded to this convention of:
a. any signature;
b. the deposit of any instrument of ratification, acceptance, approval or accession;
c. any date of entry into force of this convention in accordance with Articles 22, 23 and 24;
d. any other act, notification or communication relating to this convention.
In witness whereof the undersigned, being duly authorized thereto, have signed this Convention.
Done at Strasbourg, the 28th day of January 1981, in English and French, both texts being equally authoritative; in a single copy which shall remain deposited in the archives of the Council of Europe. The Secretary General of the Council of Europe shall transmit certified copies to each member State of the Council of Europe and to any State invited to accede to this Convention.
KONVENCIJA
O VARSTVU POSAMEZNIKOV GLEDE NA AVTOMATSKO OBDELAVO OSEBNIH PODATKOV
PREAMBULA
Države članice Sveta Evrope podpisnice te konvencije se
– ob upoštevanju, da je cilj Sveta Evrope doseči večjo enotnost njegovih članic, ki temelji zlasti na spoštovanju zakonitosti kot tudi človekovih pravic in temeljnih svoboščin;
– ob upoštevanju, da je treba širiti obseg varstva pravic in temeljnih svoboščin in še posebej pravico do spoštovanja zasebnosti ob naraščajočem pretoku osebnih podatkov čez državne meje, s sredstvi za avtomatsko obdelavo;
– zavedajoč se hkrati svojih obveznosti pri odpravi ovir, ki jih povzročajo meje, za prost pretok podatkov;
– ob spoznanju, da je treba spoštovati temeljna načela zasebnosti in zagotoviti svoboden pretok informacij med narodi,
strinjajo o naslednjem:
I. POGLAVJE – SPLOŠNE DOLOČBE
1. člen
Predmet in namen
Namen te konvencije je zagotoviti na ozemlju vsake pogodbenice vsakemu posamezniku ne glede na državljanstvo in prebivališče spoštovanje njegovih pravic in temeljnih svoboščin in v tem okviru še posebej spoštovanje pravice do zasebnosti glede na avtomatsko obdelavo osebnih podatkov, ki se nanašajo nanj (»zaščita podatkov«).
2. člen
Definicije
Za namen te konvencije:
a) "osebni podatek" pomeni katero koli informacijo, ki se nanaša na določenega ali določljivega posameznika (nosilec podatkov);
b) "avtomatska zbirka podatkov" pomeni kakršne koli podatke, ki se avtomatsko obdelujejo;
c) "avtomatska obdelava" vključuje naslednje operacije, če so v celoti ali deloma podprte z avtomatskimi sredstvi: shranjevanje podatkov, uporaba logičnih in (ali) aritmetičnih operacij pri delu s temi podatki, njihova predelava, brisanje, iskanje ali širjenje;
d) "upravljavec zbirke podatkov" pomeni fizično ali pravno osebo, državni organ, organizacijo ali katero koli drugo telo, ki je po nacionalni zakonodaji pristojno za, odločanje o tem, kaj je lahko namen avtomatske datoteke, katere kategorije osebnih podatkov so lahko v njih shranjene in katere oblike obdelave so dopustne.
3. člen
Obseg
1. Pogodbenice bodo zagotovile spoštovanje določil te konvencije glede avtomatskih zbirk podatkov, ki vsebujejo osebne podatke, in avtomatske obdelave osebnih podatkov tako v javnem kot tudi zasebnem sektorju.
2. Vsaka država lahko ob podpisu ali ob shranitvi svojih ratifikacijskih listin ali kadar koli kasneje predloži izjavo generalnemu sekretarju Sveta Evrope:
a) da ne bo uporabljala določil te konvencije glede določenih kategorij avtomatskih zbirk podatkov, ki vsebujejo osebne podatke, katerih seznam bo shranjen. Na to listo ne bo vključila kategorij avtomatskih zbirk podatkov, za katere velja njena nacionalna zakonodaja o zaščiti podatkov. Kasneje lahko to listo spremeni z novo izjavo, kadar koli se določijo dodatne kategorije avtomatskih zbirk podatkov, ki vsebujejo osebne, podatke, za katere veljajo določila nacionalne zakonodaje o zaščiti podatkov;
b) da bodo zagotovile uporabo določil te konvencije. tudi pri informacijah, ki se nanašajo na skupine oseb, združenja, ustanove, družbe, korporacije in katera koli druga telesa, sestavljena neposredno ali posredno iz posameznikov, ne glede na to, ali imajo takšna telesa lastnost pravne osebe;
c) da bodo zagotovile uporabo te konvencije tudi za tiste zbirke podatkov, ki vsebujejo osebne podatke, ki niso vodene avtomatsko.
3. Vsaka država, ki razširi področje uporabe te konvencije na točko 2. b ali c, lahko v izjavi navede, da se takšna razširitev nanaša samo na določene kategorije zbirk podatkov, ki vsebujejo osebne podatke, in katerih listo bo shranila.
4. Pogodbenica, ki je izključila določene kategorije avtomatskih zbirk podatkov, ki vsebujejo osebne podatke, z izjavo po 2. a točki, ne more v teh primerih terjati
uporabe določil te konvencije od druge udeleženke, ki jih ni izključila.
5. Prav tako pogodbenica, ki ni sprejela nobene razširitve, predvidene, po točki 2. b in c, ne more terjati uporabe te konvencije v teh točkah nasproti pogodbenici, ki je sprejela te razširitve.
6. Izjave, ki so predvidene, v točki 2, učinkujejo od trenutka veljavnosti konvencije glede na državo, ki je izjave dala, če so bile dane ob podpisu ali shranitvi listin o ratifikaciji, sprejemu, odobritvi ali pristopu, ali po treh mesecih, ko jih je prejel generalni sekretar Sveta Evrope, če so bile dane kasneje. Te izjave se lahko kasneje umaknejo v celoti ali deloma z obvestilom, naslovljenim na generalnega sekretarja Sveta Evrope. Takšni preklici začnejo učinkovati po treh mesecih od dneva njihovega prejema.
II. POGLAVJE – TEMELJNA NAČELA VARSTVA PODATKOV
4. člen
Dolžnosti pogodbenic
1. Vsaka pogodbenica bo v skladu z nacionalno zakonodajo prevzela tiste ukrepe, ki so potrebni za uresničevanje temeljnih načel zaščite podatkov, določenih v tem poglavju.
2. Ti ukrepi morajo biti sprejeti najkasneje ob začetku veljavnosti te konvencije glede na posamezno pogodbeni-
5. člen
Kakovost podatkov
Osebni podatki, ki se avtomatsko obdelujejo:
a) morajo biti pridobljeni in obdelani pošteno in zakonito;
b) smejo biti shranjeni za določene in zakonite namene in ne smej obiti uporabljeni na način, ki ni združljiv s temi nameni;
c) morajo biti primerni, ustrezni in ne smejo biti pretirani glede na namene, za katere so bili shranjeni;
d) morajo biti točni in, kjer je to nujno, do dneva ažurni;
e) smejo biti shranjeni v obliki, ki dopušča identifikacijo posameznika, na katerega se nanašajo podatki, le toliko časa, kot je to potrebno za namene, zaradi katerih so bili shranjeni.
6. člen
Posebne vrste podatkov
Osebni podatki, ki kažejo na rasno poreklo, politična, verska ali druga prepričanja, kot tudi osebni podatki, ki se nanašajo na zdravstveno ali spolno življenje, se ne smejo avtomatsko obdelovati, če nacionalna zakonodaja ne določa ustrezne zaščite. Enako velja tudi za osebne podatke, ki se nanašajo na kazenske (ob)sodbe.
7. člen
Zavarovanje podatkov
Za zaščito osebnih podatkov, shranjenih v avtomatskih zbirkah podatkov, morajo biti sprejeti ustrezni varnostni ukrepi, s katerimi se preprečujejo slučajno ali nepooblaščeno uničenje podatkov ali njihova izguba kakor tudi nepooblaščen pristop, obdelava in širjenje teh podatkov.
8. člen
Dodatni ukrepi varstva posameznika
Vsaki osebi mora biti omogočeno: a) da ugotovi obstoj posamezne avtomatske zbirke podatkov, ki vsebuje osebne podatke, njene glavne namene kot tudi sedež njenega upravljavca;
b) da dobi v razumnem času in brez večjih zamud in stroškov potrdilo o tem, kateri podatki, ki se nanašajo nanj, so shranjeni v avtomatski zbirki podatkov kot tudi izpis o teh podatkih, ki mora biti v razumljivi obliki;
c) da zahteva popravo ali izbris podatkov, če so bili obdelani v nasprotju s pravili, vsebovanimi v nacionalni zakonodaji, s katerimi se zagotavlja uresničevanje temeljnih načel iz 5. in 6. člena te konvencije;
d) da ima pravno sredstvo, če zahtevi za potrdilo ali sporočilo, popravek ali izbris v zvezi s točkama b in c tega člena ni ustreženo.
9. člen
Izjeme in omejitve
1. Glede določb 5., 6. in 8. člena te konvencije niso dopustne izjeme, razen v okviru meja, določenih v tem členu.
2. Omejitve določb v 5., 6. in 8. členu te konvencije so dopustne, kadar so predpisane v zakonu pogodbenice ob upoštevanju temeljnih vrednot demokratične družbe.V tem okviru so omejitve dopustne zaradi:
a) zaščite državne varnosti, javne varnosti, denarnih interesov države ali zatiranja kriminala;
b) zaščite dajalcev (posameznikov) podatkov ali pravic in svoboščin drugih.
3. Omejitve uresničevanja pravic, določenih v točkah b, c in d 8. člena, se lahko predpišejo z zakonom, in sicer zaradi uporabe avtomatskih zbirk podatkov, ki vsebujejo osebne podatke, za statistične ali znanstveno raziskovalne namene, vendar če ni nevarnosti za kršitev zasebnosti posameznikov, na katere se podatki nanašajo.
10. člen
Sankcije in pravna sredstva
Vsaka pogodbenica bo določila primerne sankcije in pravna sredstva ob kršitvah določil nacionalne zakonodaje, s katerimi se zagotavlja uresničevanje temeljnih načel zaščite podatkov, določenih v tem poglavju.
11. člen
Razširjena zaščita
Nobena od določb tega poglavja se ne more razlagati omejujoče ali tako, da bi kakor koli ovirala možnosti pogodbenicam, da zagotovijo posameznikom, na katere se nanašajo podatki, širšo zaščito od te, ki je dogovorjena s to konvencijo.
III. POGLAVJE – PRENOS PODATKOV ČEZ MEJE
12. člen
Prenos podatkov čez meje in nacionalna zakonodaja
1. Naslednje določbe bodo uporabljene za prenos osebnih podatkov čez nacionalne meje ne glede na sredstvo ali stopnjo njihove avtomatske obdelave.
2. Pogodbenica ne more samo zaradi zaščite zasebnosti prepovedati prenosa ali zahtevati posebno privolitev prenosa osebnih podatkov čez nacionalne meje na ozemlje druge pogodbenice.
3. Vendar vsaka pogodbenica lahko omeji določbo iz 2. odstavka tega člena:
a) v tolikšnem obsegu kot njena zakonodaja vsebuje posebne ureditve za določene kategorije osebnih podatkov ali avtomatske zbirke podatkov, ki take podatke vsebujejo, zaradi narave teh kategorij podatkov ali zbirke podatkov. Vendar tega ne more storiti, če zakonodaja druge pogodbenice določa enakovredno zaščito;
b) kadar gre za prenos podatkov z njenega ozemlja na ozemlje države, ki ni pogodbenica, čez ozemlje druge pogodbenice, z namenom preprečiti, da bi prenos pomenil obid njene zakonodaje.
IV. POGLAVJE – MEDSEBOJNO SODELOVANJE
13. člen
Sodelovanje med pogodbenicami
1. Pogodbenice se strinjajo, da si bodo medsebojno pomagale z namenom uresničitve te konvencije.
2. V ta namen:
a) bo vsaka pogodbenica določila enega ali več pooblaščenih organov ter njihova imena in naslove sporočila generalnemu sekretarju Sveta Evrope;
b) bo vsaka pogodbenica, ki bo določila in sporočila več kot en pooblaščeni organ, v sporočilu generalnemu sekretarju navedla za vsakega njegova pooblastila.
3. Pooblaščen organ ene pogodbenice mora na zahtevo pooblaščenega organa druge pogodbenice:
a) dati informacije o pravni ureditvi in upravni praksi pri zaščiti podatkov v svoji državi;
b) sprejeti v skladu s svojo nacionalno zakonodajo in z namenom zagotovitve zaščite zasebnosti vse primerne ukrepe za dajanje dejanskih informacij o posebnih avtomatskih obdelavah na njegovem ozemlju, ne glede na to, kako se obdelujejo.
14. člen
Pomoč dajalcem podatkov, nastanjenih v tujini
1. Vsaka pogodbenica bo pomagala vsaki osebi, nastanjeni na njenem ozemlju, z namenom da se pouči o pravicah, določenih v njeni nacionalni zakonodaji za uresničevanje določb 8. člena te konvencije.
2. Kadar takšna oseba prebiva na ozemlju druge pogodbenice, ji je treba omogočiti, da predloži svojo zahtevo s posredovanjem pooblaščenega organa, ki ga je določila in sporočila pogodbenica.
3. Zahteva za pomoč mora vsebovati:
a) ime, naslov in druge podatke, pomembne za identifikacijo osebe, ki vlaga zahtevo;
b) navedbo avtomatske zbirke podatkov, ki vsebuje osebne podatke in na katero se zahteva nanaša, ali pa njenega upravljavca;
c) namen oziroma cilj zahteve.
15. člen
Zaščitni ukrepi v okviru pomoči, ki jo daje pooblaščeni organ
1. Pooblaščeni organ, ki ga je imenovala pogodbenica in ki je prejel določene informacije pooblaščenega organa druge pogodbenice v okviru zahteve za pomoč ali v odgovoru na lastno zahtevo po pomoči, sme uporabiti te informacije samo za namene, ki so bili določeni v zahtevi za pomoč.
2. Vsaka pogodbenica mora paziti, da so osebe, ki pripadajo ali delajo v imenu pooblaščenega organa, zavezane k varovanju tajnosti in zaupnosti informacij.
3. V nobenem primeru ne more biti imenovanemu pooblaščenemu organu dovoljeno, da na podlagi 2. točke 14. člena zahtevo za pomoč v prid posameznika, ki ima bivališče v tujini, vloži sam od sebe in brez izrecne odobritve prizadete osebe.
16. člen
Zavrnitev zahteve za pomoč
Imenovani pooblaščeni organ, na katerega je naslovljena zahteva za pomoč na podlagi 13. ali 14. člena te konvencije, zahteve ne more zavrniti, razen če:
a) zahteva ni skladna s pooblastili, ki jih ima pri zaščiti podatkov;
b) zahteva ni skladna s pogoji, ki jih določa ta konvencija;
c) bi bila izpolnitev zahteve v nasprotju s suverenostjo, varnostjo ali javnim redom pogodbenice, ki ga je imenovala, ali pa v nasprotju s pravicami in temeljnimi svoboščinami oseb, ki so pod jurisdikcijo pogodbenice.
17. člen
Stroški in postopek v zvezi s pomočjo
1. Plačilo za medsebojno pomoč, ki jo dajejo pogodbenice druga drugi na podlagi 13. člena in pomoč, ki jo dajejo osebam v tujini na podlagi 14. člena, ne smeta biti višja od stroškov in plačil, potrebnih za izvedence in tolmače. Omenjene stroške in plačila krije pogodbenica, ki je imenovala pooblaščeni organ, ki je zaprosil za pomoč.
2. Na posameznike na katere se nanašajo podatki in v korist katerih so bili izpeljani postopki na ozemlju druge pogodbenice, ne morejo biti preneseni stroški ali plačila, razen tistih, ki jih po predpisih te pogodbenice plačujejo njeni državljani.
3. Druge podrobnosti, ki se nanašajo na obliko, postopke in jezik v okviru pomoči, uredijo med seboj prizadete pogodbenice same.
V. POGLAVJE – POSVETOVALNI ODBOR
18. člen
Sestava odbora
1. Po pričetku veljavnosti te konvencije bo ustanovljen posvetovalni odbor.
2. Vsaka pogodbenica bo imenovala v odbor po enega predstavnika in po enega namestnika. Vsaka država članica Sveta Evrope, ki ni pogodbenica te konvencije, ima pravico, da jo v odboru predstavlja opazovalec.
3. Posvetovalni odbor lahko na podlagi soglasne odločitve povabi vsako državo nečlanico Sveta Evrope, ki ni pogodbenica te konvencije, da pošlje opazovalca na določen sestanek.
19. člen
Naloge odbora
Posvetovalni odbor:
a) lahko daje predloge za pospešitev ali izboljšanje uporabe konvencije;
b) lahko daje predloge za dopolnitve te konvencije v skladu z 21. členom;
c) lahko oblikuje mnenje o vsakem predlogu za dopolnitev te konvencije, ki mu je poslan v skladu s 3. točko 21. člena;
d) na zahtevo pogodbenice lahko da mnenje o vsakem vprašanju, ki se nanaša na uporabo te konvencije.
20. člen
Postopek
1. Posvetovalni odbor bo skliceval generalni sekretar Sveta Evrope. Njegovo prvo zasedanje bo sklicano v dvanajstih mesecih od začetka veljavnosti te konvencije. Sestajal se bo najmanj enkrat na dve leti in vsakič, ko bo njegov sklic zahtevala ena tretjina predstavnikov pogodbenic.
2. Potrebno število prisotnih na zasedanju posvetovalnega odbora je doseženo, če je prisotna večina predstavnikov pogodbenic.
3. Po vsakem zasedanju bo posvetovalni odbor poročal o svojem delu in učinkovitosti konvencije Odboru ministrov Sveta Evrope.
4. Skladno z določili te konvencije bo posvetovalni odbor določil svoj poslovnik.
VI. POGLAVJE – DOPOLNITVE
21. člen
Dopolnitve
1. Dopolnitve te konvencije lahko predlagajo pogodbenice. odbor ministrov Sveta Evrope ali posvetovalni odbor.
2. O vsakem predlogu za dopolnitev bo generalni sekretar Sveta Evrope obvestil države članice sveta in vsako državo nečlanico, ki je pristopila ali pa je bila povabljena, da pristopi k tej konvenciji v skladu z določbami 23. člena.
3. Prav tako bo vsaka dopolnitev, ki jo predlaga pogodbenica ali odbor ministrov, poslana posvetovalnemu odboru, ki bo seznanil odbor ministrov s svojim mnenjem o predlagani dopolnitvi.
4. Odbor ministrov bo pretehtal predlagano dopolnitev in mnenje posvetovalnega odbora o njej in jo lahko odobril..
5. Vsaka dopolnitev, ki jo odobri odbor ministrov skladno s 4. točko tega člena, bo poslana v sprejem pogodbenicam.
6. Vsaka dopolnitev, odobrena v skladu s točko 4 tega člena, začne veljati trideseti dan od dneva, ko so vse pogodbenice sporočile generalnemu sekretarju, da jo sprejemajo.
VII. POGLAVJE – KONČNE DOLOČBE
22. člen
Veljavnost
1. Ta konvencija bo odprta za podpis državam članicam Sveta Evrope. Lahko se ratificira, sprejme ali odobri. Listine o ratifikaciji, sprejemu ali odobritvi se shranijo pri generalnem sekretarju Sveta Evrope.
2. Ta konvencija začne veljati s prvim dnem meseca, ki sledi obdobju treh mesecev od datuma, ko je pet držav članic Sveta Evrope izrazilo svojo privolitev, da jih obvezuje konvencija v skladu z določbami predhodnega odstavka.
3. Za vsako državo članico, ki je izrazila svojo privolitev, da se ji podredi, bo konvencija začela veljati s prvim dnem meseca, ki sledi preteku trimesečnega roka od datuma shranitve listin o ratifikaciji, sprejemu ali odobritvi.
23. člen
Pristop držav nečlanic
1. Po uveljavitvi te konvencije lahko odbor ministrov Sveta Evrope povabi vsako državo, ki ni članica sveta, da pristopi h konvenciji, in sicer na podlagi odločitve, sprejete z večino, predvideno v členu 20. d Statuta Sveta Evrope, in enoglasne odločitve predstavnikov držav pogodbenic, imenovanih v odbor.
2. Za vsako državo, ki je pristopila, začne konvencija veljati prvega dne v mesecu, ki sledi preteku obdobja treh mesecev od datuma shranitve posameznih listin pri generalnem sekretarju Sveta Evrope.
24. člen
Ozemeljska klavzula
1. Vsaka država lahko ob podpisu ali ob sprejemu listin o ratifikaciji, sprejemu, odobritvi ali pristopu, določi ozemlje ali ozemlja, na katerih se bo uporabila ta konvencija.
2. Vsaka država lahko kadar koli kasneje z izjavo, naslovljeno na generalnega sekretarja Sveta Evrope, razširi uporabo te konvencije na katero koli ozemlje, določeno v izjavi. Za to ozemlje začne konvencija veljati prvega dne v mesecu, ki sledi preteku obdobja treh mesecev od datuma, ko je generalni sekretar prejel izjavo.
3. Vsaka izjava na podlagi prejšnjih dveh odstavkov glede ozemlja, je lahko umaknjena z obvestilom, naslovljenim na generalnega sekretarja. Umik začne učinkovati prvega dne v mesecu, ki sledi datumu, ko je obvestilo prejel generalni sekretar.
25. člen
Pridržki
Pridržki glede določb te konvencije niso možni.
26. člen
Odpoved
1. Vsaka pogodbenica lahko kadar koli odpove to konvencijo z obvestilom, naslovljenim na generalnega sekretarja Sveta Evrope.
2. Takšna odpoved začne veljati prvega dne v mesecu, ki sledi preteku obdobja šestih mesecev od datuma, ko je generalni sekretar prejel obvestilo.
27. člen Obveščanje
Generalni sekretar Sveta Evrope obvešča države članice sveta in vsako državo, ki je pristopila k tej konvenciji, o:
a) vsakem podpisu;
b) shranitvi vsake listine o ratifikaciji, sprejemu, odobritvi ali pristopu;
c) vsakem datumu začetka veljavnosti te konvencije glede na 22., 23. in 24. člen;
d) vsakem drugem dejanju, obvestilu ali sporočilu, ki se nanaša na to konvencijo.
Da bi to potrdili, so podpisniki, ki so bili za to pooblaščeni, podpisali to konvencijo.
Sestavljeno v Strasbourgu 28. januarja 1981, v angleškem in francoskem besedilu, ki sta obe enako verodostojni, in sicer v enem izvodu, shranjenem v arhivu Sveta Evrope. Generalni sekretar Sveta Evrope bo overjen izvod tega dokumenta poslal državam članicam Sveta Evrope in državam, ki so povabljene, da pristopijo h konvenciji.
3. člen
Za izvajanje te konvencije skrbi ministrstvo, pristojno za znanost in tehnologijo.
4. člen
Ta zakon začne veljati naslednji dan po objavi v Uradnem listu Republike Slovenije – Mednarodne pogodbe.
Št. 210-01-/93-4/1
Ljubljana, dne 25. januarja 1994.
Predsednik
Državnega zbora
Republike Slovenije
mag. Herman Rigelnik I. r.
