With regard to cross-border data exchange, the Convention guarantees the free movement of personal data between Contracting Parties and imposes certain restrictions on data flows to countries where legislation does not provide equal protection.
It should be noted that Convention 108 is binding for the countries that have ratified it. It is not subject to judicial review by the ECtHR, but is taken into account in the case law of the ECtHR under Article 8 of the ECHR. Over the years, the Court has ruled that the protection of personal data is an important part of the right to respect for private life (Article 8) and is guided by the principles of Convention 108 when determining whether there is an interference with this fundamental right.
An Additional Protocol to Convention 108 was adopted in 2001. It introduced provisions on cross-border data flows to non-Parties of the Convention, the so-called third countries, and on the mandatory establishment of national supervisory authorities for the protection of data.
The goal with the drafting and adoption of the modernized version of Convention 108 (the so-called "Convention 108+") is to achieve greater coherence between the data protection law applicable within the European Union and the legislation within the Council of the Europe, where members are countries from all over the world. Although the requirement for the entry into force of Convention 108 + is the presence of 38 acceding Member States and, currently, this document has passed the procedure of signature and ratification in only 17 countries, Bulgaria applies its provisions.