To outline strategic orientations for the period 2026-2029, the Committee of the Convention for the Protection of Individuals with regard to Automated Processing of Personal Data (“The Committee”) adopted its Work Programme at its 49^th plenary meeting (3 to 5 November 2025). The Work Programme 2026-2029 (“the Programme”) was developed by the Bureau of the Committee based on information provided by the Secretariat and comments by delegations (from Parties and Observers), allowing it for framing key directions of the four-year work Programme. The Committee uses this opportunity to thank delegations for their valuable contribution to the drafting process.

The Programme aims to ensure the highest level of quality and productivity for the work of the Committee, with concrete achievements and results, depending on the resources available for the Committee (two plenary meetings and two Bureau meetings per year, subject to an annual budget equivalent or higher to one of the previous years) and the Secretariat. The Programme also considers the potential (partial) entry into force of the Protocol CETS No 223 amending Convention 108. It will surely come with a subsequent rise in the workload for the participating delegations (from Parties and Observers) and the Secretariat to deliver the necessary documents and put in place the underlying procedures required for the changing competences. This will ensure the well-functioning of the new Committee under Convention 108+ which is likely to be set up upon entry into force during these 4 years’ period.

The working methods of the Committee and its Bureau should aim to facilitate the participation of interested delegations, and all stakeholder in an inclusive manner provided they align their contributions and actions with the standards of the Council of Europe and notably with the ones provided in Convention 108+. During this period in-person meeting should be preferred while the communication between meetings should allow for reactivity and rationalization of the time and resources (ex. Using email communication, shared documents and video calls for working group meetings).

The implementation of the Work Programme 2026-2029 will be done through further participation in regional and international networks, as well as cooperation projects, and the organization of and participation in punctual and periodical events which will also contribute further to the visibility and promotion of the Protocol CETS No. 223 amending Convention 108 (“Convention 108+”).

2. Functions of the Convention Committee

The functions, operations, and activities of the Committee derive from Articles 19 and 20 of Convention 108, as well as from the Rules of Procedure (T-PD43(2022)7). As defined in Paragraph 85 of the Explanatory Report, the Committee is to “facilitate the smooth running of the convention and, where necessary, to perfect it”.

In this respect, the Committee:

· May make proposals with a view to facilitating or improving the application of the Convention;

· May make proposals for amendment of this Convention in accordance with Article 21;

· Shall formulate its opinion on any proposal for amendment of this Convention which is referred to it in accordance with Article 21, paragraph 3;

· May, at the request of a Party, express an opinion on any question concerning the application of this Convention.

In addition, it derives from Article 9bis of the Rules of Procedure that the Committee:

shall adopt the work programme and determine priorities;
shall draw up draft legal instruments with a view to their adoption by the Committee of Ministers;
shall adopt opinions and reports;
shall decide on the establishment of working parties, on their composition and on their terms of reference;
shall elect a Chair and two vice-Chairs and the other members of the Bureau following the requirements set out in Articles 10 bis and 10 ter;
shall adopt the terms of reference of the Bureau.

3. Highlights of the Committee’s Work Carried Out in 2022-2025

The Committee has been active based on its Work Programme 2022-2025 in:

Welcoming 18 ratifications^{^[1]} of the Protocol CETS No 223 amending Convention 108 which is an extremely high number et reflects the commitment of the Parties to bring Convention 108+ into force; registering a number of expression of intent for the accession to Convention 108+ by non-Parties

Adopting the [Guidelines on the Protection of Individuals with regard to the Processing of Personal Data by and for Political Campaigns (2022)], Guidelines on National Digital Identity (2023), Data protection for the Processing of Personal Data for Anti-Money Laundering/Countering Financing of Terrorism Purposes (2024), Guidelines on the Protection of Individuals with regard to the Processing of Personal Data for the Purposes of Voter Registration and Authentication (2024), Guidelines on the general principles of Article 11 of the Modernised Convention 108 (2025);

Adopting Model Contractual Clauses for the Transfer of Personal Data (MCCs), which aim to ensure an appropriate level of protection for the transfer of personal data to countries that are not Parties to Convention 108 as amended by the Protocol CETS No. 223;

Discussing topics of high relevance based on two expert reports on the privacy and data protection implication of the use of neurotechnology and neural data from the perspective of Convention 108 (2024) and privacy and data protection risks in Large Language Models (LLMs) (2025) and initiating the development of normative documents in both area;

Exchanging on the latest trend regarding the enforcement of Article 8 of the ECHR based on the compilation prepared by the Secretariat on the Case Law of the European Court of Human Rights Concerning the Protection of Personal Data

Granting observer status to the Organization of American States (OAS), Burkina Faso Data Protection Authority (CIL), the Chilean Association of Professionals in Personal Data Protection, the Colombian Data Protection Authority, Ecuador (represented by the Superintendencia de Protección de Datos Personales), Organization of American States, and Network of African Data Protection Authorities (NADPA);

Cooperating with other CoE Committees on issues related to the Artificial Intelligence and data protection (CAI), children’s rights (C-DENF), human rights and biomedicine (CD-BIO), digital technologies on freedom of expression, electoral communication, quality journalism and on combatting hate speech (CD-MSI), strengthening democracy, its institutions and processes and good governance (CDDEM), international data transfers in the area of sport integrity (Macolin Convention), anti-money laundering/countering financing of terrorism (MONEYVAL), cybercrime (T-CY), freedom of information and access to official documents (Tromsø Convention), the rule of law checklist (Venice Commission).

In consequence of the aggression of the Russian Federation against Ukraine, and based on the subsequent decisions of the Committee of Ministers (CM/Res (2022)3, CM/Inf (2022)17-rev, CM/Del/Dec (2022)1438/2.3), the Committee adopted two amendments to Rules 9bis and 15 of its Rules of Procedure introducing measures to restrict the participation of — among other things — a State Party “that has ceased to be a member of the Council of Europe following the procedure launched under Article 8 of the Statute of the Council of Europe for a serious violation of Article 3 of the Statute” in its work.

4. Objectives of the Work Programme 2026-2029

Objective 1: Entry into Force of CETS No. 223

Despite a rapid flow of signatures from the very day of the opening of Protocol CETS No. 223 amending Convention 108 (46 to date), 5 more ratifications (33 to date) are needed for the Protocol to enter into force (partially). The Committee will therefore continue to pay particular attention to the dynamics of signatures and ratifications of the Protocol CETS No. 223 with a view to ensure the entry into force of Convention 108+ in line with the decision of the Committee of Ministers (CM/Del/Dec (2018)128/5).

An important share of the Committee in the coming years will remain to bring this process to a successful conclusion. To this end, the Committee will continue to provide its expertise for an effective implementation of the protection of privacy and personal data in the national legislative framework of Parties and Observers to the Convention, as well as to any country interested in applying the standards and mechanism of Convention 108+.

Objective 2: Follow Up on Existing Normative Activities by the Committee

The Committee will aim to ensure the follow-up of its normative activities undertaken under its Work Programme 2022-2025 and will continue to work on developing guidelines on data protection in the context of neurosciences, as well as on data protection in the context of Large Language Models-based systems (LLMs). The Committee will stand ready providing interpretations of provisions of the Convention 108+ if required.

The Committee will also aim to discuss topics pertaining to the transition from Convention 108 to Convention 108+, with a view also to the necessary documentation (rules of procedures, terms of reference, methodology for the first round of evaluation and follow up); ensure the visibility and promotion of the Convention 108+ through events such as the International Data Protection Day, conferences, symposiums, seminars, working groups, etc. and the Stefano Rodota award.

Objective 3: Further Actions Regarding Transborder Flows of Personal Data

The Committee will continue advancing its work on transborder flows of personal data. The Committee will: (TBC by the plenary)

A. Assisting and supporting the recognition and approval of the CoE MCC by the competent authorities in the Parties (DPAs and other competent authorities) and by strategic partner organisations, institutions. Developing an Action Plan on the approval of the CoE MCC’s in Parties of Convention 108+, including a specific guidance for transforming CoE MCC into an easily transposable, operational instrument to ensure its accessibility and wider use.

B. An inventory of the data transfer regimes and tools is to be developed by the Committee based on the Art. 14 of the Convention 108+ and is to be published on the webpage by the Secretariat. Development of guidelines on provisions on the legal basis for transborder flows of personal data to support operational functionality of data transfer regimes and other available transfer tools based on Article 14.

C. Promoting CoE standards and tools (such as CoE MCC) in other data protection platforms or forums. Developing report, studies and guidance, if required on global convergence to contribute to ongoing discussions on transborder flows of data in other forums.

[Option 1

Objective 4: Privacy and Data Protection within in the framework of public security and defence

The Committee will discuss the practical implementation of the adopted Guidelines on the General Principles of Article 11 at national level. As a follow up, it may decide to continue providing guidance on the implementation of Article 11 of Convention 108+ or to lunch a new normative workstream on one of the connected topics. It will continue to follow other normative developments in this field (in particular on data retention, encryption, cooperation in cybercrime by the European Union and access to data held by private parties by government by the OECD) and provide opinion upon request or start subsequent normative activities.

Considering that national security and defence are areas where more guidance and interpretation would be needed, particular attention will be paid to take on board such initiatives. Based on that work, the Committee will aim overall to prepare or create a forum on privacy and public security for facilitate exchanges and cooperation between interested stakeholders (such as national authorities, oversight bodies, institutions, etc).

Option 2

Objective 4: Privacy protection and democratic security

At the European Political Community meeting in Copenhagen, the Secretary General of the Council of Europe stated that “military security and democratic security must go hand in hand.”

He also presented two flagship initiatives: the New Democratic Pact for Europe, aimed at rebuilding trust in institutions, and a future Council of Europe Convention on disinformation and foreign interference. He confirmed growing support from European leaders, as well as closer practical cooperation with NATO to link military and democratic security. To complement or supplement those strategic actions, the Committee could embark on activities related to one or both flagship initiatives by discussing and providing standards and/or expertise on the protection of privacy in the current changing geopolitical context.]

Objective 5: Cooperation With Other Committees, Institutions

The Committee will continue its cooperation with other Committees and institutions, in particular on access to official documents (Tromsø Convention), AI (Framework Convention on Artificial Intelligence, Human Rights, Democracy, and the Rule of Law), cybercrime (the Budapest Convention and its additional Protocols), the children’s rights (CAHENF), human rights and biomedicine (CD-BIO), digital technologies on freedom of expression, electoral communication, quality journalism and on combatting hate speech (CD-MSI), strengthening democracy, its institutions and processes and good governance (CDDEM), international data transfers in the area of sport integrity (Macolin Convention), the Parliamentary Assembly and its committees (PACE) and other respective themes stemming from this Work Programme.

5. Tackling New Challenges

The Committee should, if necessary, be able to adapt its work program to new needs to address other emerging and urgent challenges.

[1] Armenia – 25 January 2022; Romania – 9 March 2022; Austria – 13 July 2022; Albania — 22 July 2022; Andorra – 18 October 2022; Iceland – 20 January 2023; France – 27 March 2023; Argentina – 17 April 2023; Lichtenstein – 17 May 2023; Slovakia – 15 June 2023; Slovenia – 20 June 2023; Bosnia and Herzegovina – 7 July 2023; Switzerland — 7 September 2023; Portugal – 18 October 2023; Hungary – 19 October 2023; San Marino – 16 November 2023; Greece – 5 March 2025; Monaco – 6 March 2025