WILL EU PRIVACY RIGHT CONCERNS IMPEDE CRITICAL COUNTER-TERRORISM INFORMATION SHARING?

By Victor Comras

Four years ago I had the opportunity to write a blog here concerning a controversial story in the New York Times which revealed the ongoing sifting of SWIFT intra bank transfer information by US intelligence agencies. The NYT report incensed US government officials who viewed the revelation as a serious setback in their ability to use "follow the money" strategies for tracing and finding terrorist cells. They were deeply concerned that the article had alerted those funding terrorism to the practice and that they would now avoid such transfers. But, the real damage to the program came from a different source – the European-wide outcry concerning what Europeans perceived as violations of their privacy rights. The NYT story provoked an arduous European reconsideration of its data sharing practices and a debate over the correct balance between preserving privacy rights and effectively combating terrorism and terrorism financing. This debate continues today.

Last month members of the European Parliament took up two important resolutions related to data sharing with the United States. They expressed strong concerns over the way the EU Council and Commission were handling these issues with the United States, particularly in the areas of banking data and traveler-related information. And, they warned the EU leadership that they would continue to stand in the way of any agreement which unduly sacrificed privacy rights or subjected private data to potential abuse. They also provided their own advice and guidance to the EU Council and Commission on what safeguards information sharing agreements with the United States must contain.

Bank data transfers

International bank account transfers are now channeled, for the most part, through correspondent banking relationships and large-value message and payment clearance systems. The Belgium based Society for Worldwide Interbank Financial Telecommunication ("SWIFT") is one of the largest of these clearing centers, handling some 3.76 billion transaction messages and linking some 8,740 financial institutions in 209 countries. It seemed quite evident and logical that the US would target these critical banking transfer nodes to obtain vital information concerning the financing of terrorism and to trace and locate terrorist cells. And that is precisely what the US Treasury Department did under its Terrorism Finance Tracking Program (TFTP). It developed its own criteria for identifying and subpoenaing specific records and data from Swift.

Following publication on June 23, 2006 of the New York Times story about this practice, and the resulting European uproar, the EU and US agreed to put in place a more formal accord which called for procedures to protect against unauthorized use of the data gleaned from the TFTP SWIFT program. But, European Parliamentarians balked at the arrangement. They insisted that more specific safeguards be put in place that would comply fully with EU privacy legislation. On February 11, 2010, the EU Parliament formally rejected (378 to 196 with 31 abstentions) the US-EU interim data sharing agreement, causing considerable consternation in both European and US counter-terrorism circles.

With the data sharing agreement now supposedly in abeyance, MEP’s have moved forward on providing specific guidance to the EU Council on the protections they want. A new resolution, passed by a raised hands vote, foreclosed inclusion of so-called bulk data sharing and transfers. They also insisted that any new agreement include "strict implementation and supervision safeguards, monitored by an appropriate EU-appointed authority." This authority would be charged with filtering the day-to-day extraction of and use by the US authorities of all such data. The maximum storage period, they indicate, must not exceed five years and the data may not be disclosed to third countries. They also insist on reciprocity that would require the United States to permit EU authorities access to data stored in servers in the US. Finally, they insist that Europeans be given the same rights and access to US courts to challenge errors, and unauthorized use and abuse of the shared data. At present the privacy rights guaranteed under the US Privacy Act can only be invoked by US citizens and permanent residents of the United States.

Passenger name records (PNRs)

While deferring official Parliamentary action on the sharing of information gathered on potential travelers, the MEPs nevertheless reflected grave concerns on the current arrangements in place. The US now requires all airlines flying to the United States to provide the Department of Homeland Security with full electronic access to detailed personal information on all passengers, in the form of Passenger Name Records (PNRs). The MEP’s are aware that interrupting this process might seriously impede international travel. Therefore, they agreed to postpone taking any action. Rather, they indicated in committee discussions with the EC Commission that they wanted the Commission to move ahead on drafting a model PNR and procedures for safeguarding the information against potential abusive release or use.

PNR's contain data collected by airline reservation systems on individuals who make reservations whether or not they actually travel. Each entry is logged in a PNR "history" which is retained by the various reservation systems now in operation. Over time they put together a more complete profile of the potential traveler including the places he has gone, when, with whom, for how long, and at whose expense. This information can be very useful, and is often essential, in identifying potentially dangerous travelers and subjecting them to closer inspection or “no fly” restrictions.

The appropriate balance between protecting privacy rights and counter-terrorism concerns entails many subjective determinations. The essential element in preserving privacy and combating terrorism must be the confidence that has hopefully already developed between US and counter-part EU agencies which have already long handled and processed such data. Few, if any, cases of abuse have arisen so far. Perhaps it is time to rely on this close cooperation and confidence, rather than on new detailed legislated rules, and to make sure that vital counter-terrorism information is available and appropriately assessed in a timely fashion.