EU-US data-sharing deals renew privacy concerns

Commission Vice-President Franco Frattini, commissioner responsible for justice, freedom and security said: "The EU and its most important strategic partner in the fight against terrorism, the US, have to join forces in this fight, including the financing of terrorism. However, these activities should be done in full respect of fundamental rights, including notably data protection rights and the right to privacy of EU citizens.

"I am therefore now looking to SWIFT and to the financial institutions that use its services to take the necessary steps so that SWIFT will be in compliance with the Data Protection Directive and may have recourse to the Safe Harbour mechanism, that allows limitations on its data protection principles for important public purposes 'to the extent necessary to meet national security, public interest or law enforcement requirements'."

European Data Protection Supervisor Peter Hustinx, in a letter to German Interior Minister Wolfgang Schäuble, who has been instrumental in securing the PNR deal, said: "The agreement will allow the US to retain information about passengers for 15 years, up from three at present, while placing no limitation to what US authorities are allowed to do with the data." 

The European Parliament's rapporteur for the PNR-agreement, MEP Sophie in ´t Veld (D66, Netherlands) expressed her concern about "the threat to the privacy of Europeans as a result of this PNR deal": "The PNR deal is simply bad. The purposes for which the personal data can be used is not sufficiently defined. Furthermore, data are being used not only for investigations but also for profiling and data mining (automated computer system) that makes profiles of individuals based on the collected data. 

"Furthermore, the US authorities can store the data for up to 15 years (against 3,5 years in the current agreement), they will be allowed to log directly onto European computer reservation systems and the US can renege upon the agreement unilaterally."

She was less critical over the SWIFT agreement: "The purpose is strictly limited to fighting terrorism, the data will not be used for profiling, the retention period is shorter and there is slightly better monitoring of compliance. Furthermore, the national parliaments have no other option than to approve."

"However, it remains unacceptable that such a sensitive agreement has been treated as a mere administrative formality negotiated by civil servants without a debate in the European Parliament or indeed in national parliaments. PNR and Swift are only the tip of the iceberg; each individual measure is not only an infringement of privacy but the accumulative effect is that the authorities have access to a wide range of data from Google, emails, credit card data, insurance companies, medical files and so on."

MEP Alexander Alvaro (FDP, Germany) who authored a report for the Parliament on international financial transactions considered the 28 June agreement on SWIFT to be broadly acceptable:"It is a balanced agreement with high hurdles to be overcome before sensitive data can be released to authorities not connected specifically with the fight against terrorism. It also provides for supervision and an external auditor to ensure it is being correctly implemented," he said.