SWIFT (Society for Worldwide Interbank Financial
Telecommunication) processes 11 million European financial
transactions and it emerged earlier this year that since 2001 it
has allowed US security agencies access to many of those
transactions.
The Article 29 Data Protection Working Party, the independent EU
advisory body on data protection and privacy, has said that SWIFT's
actions broke both European and Belgian law in allowing the data to
be transferred.
"The Article 29 Working Party emphasizes that even in the fight
against terrorism and crime fundamental rights must remain
guaranteed," said a statement from the group. "The Article 29
Working Party insists therefore on the respect of global data
protection principles."
The group said that SWIFT and the financial institutions whose
transactions it processed bore joint responsibility for the
transfers.
"As far as the communication of personal data to the US Treasury
is concerned, the Working Party is of the opinion that the hidden,
systematic, massive and long-term transfer of personal data by
SWIFT to the US Treasury in a confidential, non-transparent and
systematic manner for years without effective legal grounds and
without the possibility of independent control by public data
protection supervisory authorities constitutes a violation of the
fundamental European principles as regards data protection and is
not in accordance with Belgian and European law," said the
group.
"The existing international framework is already available with
regard to the fight against terrorism. The possibilities already
offered should be exploited while ensuring the required level of
protection of fundamental rights," it said.
Already Belgium's own Privacy Commission had found that SWIFT
broke Belgian law, and the Swiss Federal Data Protection
Commissioner said that Swiss banks had broken the law by allowing
their data to be transferred.
The EU data protection group will now seek talks with SWIFT to
outline their concerns and try to change the situation.
"They have to change their system," Peter Schaar, head of the
Working Party, told Reuters news agency. "We hope we find ways to
find a situation of compliance with EU law."
It has also emerged that the Federal Prosecutor of Brussels is
investigating whether or not there are grounds for a prosecution
involving SWIFT.
The information was requested by the US to help its intelligence
gathering in the aftermath of the terrorist attacks in the US on
11th September 2001. SWIFT has previously told OUT-LAW that it
believed that it had to comply with subpoenas issued in the US
because some of the data was stored in the US.
European data laws say that personal information must not be
transferred out of Europe to countries with weaker data protection
laws than Europe. The US has weaker data protection laws than
Europe.
SWIFT is a money transfer organisation with 7,500 customer
organisations, including most of Europe's big names in banking.
