- Ministers from all European Union member states have agreed guidelines for negotiations with the United States in anticipation of an international agreement to make European based financial payment messaging data available to the US Treasury Department in order to prevent terrorism and terrorist financing.
- Whilst this will widen the access that the US has to European databases, there are also plans for the privacy protection of such data to be simultaneously stepped up.
In this recent development, Ministers from the 27 European Union member states have backed plans to:
- continue to allow US authorities to inspect the details of Europeans' bank transfers in SWIFT's US servers; and
- allow the US authorities to have access to transfers that do not otherwise reach the SWIFT's US servers.
The Society for Worldwide Interbank Financial Telecommunication (SWIFT) is a Brussels-based organisation that handles international payments message transfers between banks. SWIFT's data sharing arrangements with the US authorities became high profile back in 2006 when it was made public that SWIFT transfer messages were being monitored by US authorities.
At the time, SWIFT had data centre servers in the US which not only dealt with messages for the US business but also duplicated the message details (commonly referred to as 'mirroring') held on its EU data centre. The US servers were being monitored by US authorities which therefore included both US and EU payments messages. The EU data protection commissioners investigated and held that such transfers were unlawful. This led to a separation of the messages that spanned across the EU and US servers so that European data was not mirrored on the US servers when such a transfer was not needed, in other words, when there was no need for the payment message to be sent to the US.
In this recent development, EU Ministers have given their approval for plans to continue to allow the US authorities to have access to payment message details within the European operations and currently outside the US servers. The EU ministers made it clear that they would allow the US to have access even to message details for payments transfers that do not otherwise need to reach the US servers.
In a statement from the EU Council, the EU Ministers approved "guidelines for negotiations with the United States for an international agreement to make financial payment messaging data available to the US Treasury Department in order to prevent terrorism and terrorist financing". Under the current interim arrangement, the US authorities have access only to the information that passes through the US servers so it is clear that the EU is now moving towards widening that access to databases held in the EU. However it was also stated that any deal that gave access to EU-only transactions would also increase privacy protections for that data.
SWIFT has plans to open a new data centre in Switzerland and this new data centre will only deal with EU transactions. It is clear that further discussions will continue in relation to the level of access that US authorities will be afforded to the EU data, the exact data fields, whether its a 'push' or a 'pull' solution, and the terms on which such data is accessed. This wider approach to data sharing may be a welcome sign to other organisations that may be caught in a difficult situation where on the one hand EU data laws may prohibit certain transfers to US and on the other hand facing demands from US authorities to have access to EU data. In many of these situations EU data controller entities have been calling for the issues to be resolved at governmental level and whilst there will inevitably be concern in some quarters about the decision to widen data sharing in this context, the EU being more proactive in such arrangements may no doubt be a welcome intervention. In any event, this issue shows just how carefully data controllers need to tread when dealing with international data transfer and disclosure issues.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
