The Belgian Data Protection Commissioner ruled earlier this week that SWIFT acted illegally in transferring personal data to the US. SWIFT provides communication services between financial institutions. Since that ruling, the European Central Bank has been criticised by the European Data Protection Supervisor for failing to do anything when it became aware of these transfers.
SWIFT's data transfers
- SWIFT processes transactions made between international banks. It stores its data at 2 data centres - one in Europe and one in the USA. Both contain the same data.
- After 9/11, the US government issued multiple subpoenas to SWIFT. After negotiation to ensure that the US authorities would only search the data if relevant to an investigation into terrorism, SWIFT began transferring details of transactions between international banks to the US authorities.
- This became public knowledge in June 2006. The Belgian Data Protection Commission received complaints about the transfers from numerous countries.
A story by Privacy International, which itself complained about the transfers, gives further detail.
Belgian Data Protection Commissioner ruling
Earlier this week the Belgian Data Protection Commissioner ruled that the transfers of personal data to the US authorities were illegal and that SWIFT should have complied with its data protection obligations.
English translation (this has not been approved by the Belgian Data Protection Commissioner)
European Data Protection Supervisor criticises European Central Bank
Following the ruling, the European Data Protection Supervisor,the EU supervisory authority on data protection matters, issued preliminary findings on the matter. The Supervisor found that the European Central Bank should have acted when it became aware of the transfers, and should have made them public as early at 2002. In a statement Peter Hustinx, who is the current Supervisor, said:
"We have not concluded our investigation on ECB's role yet, but there are already some observations that I can share publicly. I basically challenge the fact that the ECB continued to allow confidential client banking data to pass to the US although it had become aware of the systematic access by American authorities. Moreover, I cannot help feeling that the ECB should have at least felt morally obliged to inform European governments and authorities about this scheme."
Comments