The Society for Worldwide Interbank Financial Telecommunication (SWIFT for short - fortunately) has been held by EU data protection authorities to have breached EU law by supplying personal data to the US Treasury (UST). SWIFT has it seems been supplying the UST with details of individual financial transactions for years. The Belgian authorities are also said to be looking at whether prosecutions are called for.
The EU's "Article 29 Working Party" has issued a formal press release setting out its finding that SWIFT and various of its customer banks breached EU Data Protection Directive 95/46/EC, and stipulating steps SWIFT must take.
SWIFT is no fly-by-night institution - according to its website, it provides messaging services to 8,000 financial institutions in over 200 countries. It is said to handle more than 11 million messages a day. Although headquartered in Belgium, SWIFT runs operation centres in the EU and the US - and there, no doubt, lay a significant part of the problem. SWIFT was served with subpoenas by the US Government demanding message information held in the USA.
SWIFT has issued its own statement which is available on its website. SWIFT is adamant that the legal advice it received (and it can presumably afford good lawyers) was that failure to comply with the US subpoenas could lead to criminal sanctions and even jail time. Who's to say they were wrong ? Anyone who has paid even casual attention to the US legal system of late will already be familiar with the severity of its penalties and the international view it takes of its own jurisdistion - ask the "Nat West Three", or any on-line gaming company executive.
SWIFT clearly has a foot in two jurisdictions imposing competing legal duties, and seems to have been in the same invidious position as the airlines over passenger information. Given that the boundaries of national jurisdictions correspond less and less to those of global commerce, businesses will find themselves in this position more and more often - and through no fault of their own.
Unless they are expected simply to choose which jurisdiction they prefer to be prosecuted under, a solution will have to be found at the international level.
