Last week saw the publication of the Belgian Privacy Commission's Decision into the "SWIFT affair". The central finding by the Commission was that SWIFT had not seriously breached data protection laws. The SWIFT case is an example of the difficult position organisations can find themselves in when dealing with competing legal obligations from different countries, particularly in the field of data protection.
Background to the SWIFT affair
SWIFT (the Society for Worldwide Interbank Financial Telecommunication) is an organisation that manages international payments between banks and handles transfers to over 8000 financial organisations worldwide. SWIFT came under fire from data protection authorities around Europe for sharing its financial data with the US Treasury in the aftermath of 9/11 without the knowledge of the data subjects. The transfers only came to light in 2006, some five years later, after a report in the New York Times.
As SWIFT had a data centre in the US, the authorities there were able to subpoena SWIFT to hand over the data. However in doing so SWIFT was breaking European data protection law.
The vast array of legal issues surrounding the secret sharing of information by SWIFT have been hotly debated for the past two years with the European Parliament recommending in February last year that SWIFT should stop storing data in the US. SWIFT is now going ahead with a planned restructuring of its network and the withdrawing of processing at its US operating centre at the end of 2009.
Data Protection Law
In the UK the eighth principle of the Data Protection Act 1998 prohibits the transfer of personal information to countries or territories outside the European Economic Area (which consists of the 27 EU member states, Iceland, Liechtenstein and Norway) unless the recipient country provides adequate protection for the rights and freedoms of individuals in relation to the processing of information about them. So far only Argentina, Canada, Guernsey, Jersey, Isle of Man and Switzerland have been deemed adequate.
The EU considers US privacy laws inadequate to protect the privacy of the individuals whose details are stored in the financial records. However even though the US has fewer privacy protections than that of the European Union, personal information can be transferred to companies in the US that have signed up to the 'Safe Harbor' agreement. The companies agree to abide by the safe harbor rules which sets out conditions similar to those found under EU data protection law. SWIFT did not have a safe harbor agreement in place at the time of the transfers, therefore there was no guarantee that the secret data being passed out of the EU was secure.
In 2007 the EU reached an agreement with the US over SWIFT's European Banking Data by introducing the following safeguards which it would oversee:
- US Treasury was only to use data received exclusively for counter-terrorism purposes;
- the US treasury's requests for data have to be specific - "Fishing expeditions" are not permitted;
- the information had to be confirmed from a separate source before being used;
- control mechanisms set up to ensure compliance with these conditions; and
- all customers whose transactions could be tracked by the US authorities were to be informed by 1 September 2007.
SWIFT appears to have been made the scapegoat for a much larger problem of international control of privacy rights. It is particularly unsatisfactory that despite the new safeguards that SWIFT introduced, the primary solution to the competing issues has been to withdraw from the USA. Surely a USA/EU data protection pact could be negotiated to provide a framework for similar organisations that are not eligible for safe harbor?
The Belgian and European authorities had already found that SWIFT acted illegally in sharing the data, but admonished SWIFT because it did its best in a difficult situation (being faced with the wrath of the US in its fight against terrorism or the EU in breaching its prized data protection laws). The recent decision of the Commission appears to have taken a view in a similar vein – absolving SWIFT of punishment and concluding that it is now compliant with Belgian data protection law.
It is very much doubted that the publishing of the Commission's Decision will be the end of the matter and we will have to wait until the end of 2009 to see what, if any, new issues the re-organisation of SWIFT will expose.
MacRoberts offers a comprehensive data protection compliance service.
Disclaimer
The material contained in this article is of the nature of general comment only and does not give advice on any particular matter. Recipients should not act on the basis of the information in this e-update without taking appropriate professional advice upon their own particular circumstances.
