Internationally, the Council of Europe (CoE) “Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data” provides legal norms on the collection of sensitive data. In addition, the CoE European Convention on Human Rights, and the UN International Covenant on Civil and Political Rights further codify the protection of privacy.

The CoE ‘Convention for the Protection of Individuals with Regard to Automatic Processing of Personal Data’ (link ) (ETS Convention No. 108) is the only international agreement specifically dedicated to data protection. It came into force in 1985 and has been signed or ratified by all 47 Member States. It only applies to identifiable persons, and therefore does not include anonymized data. It mainly regulates the processing and storage of data. The collection of data needs to be reasonable and lawful. Article 6 prohibits the automatic processing of sensitive data, unless domestic law provides appropriate safeguards. Article 8 provides that any person may consult, edit, or delete their data.

The European Convention on Human Rights includes in its definition of the right to respect for private and family life the protection of private data. The International Covenant on Civil and Political Rights by the United Nations, also known as the ICCPR, prohibits illegal encroachments into a person’s private life, and therein includes data protection.