The Council approved the text of a letter to be sent to the United States government, notifying it of the termination of the provisional application of an agreement on the processing and transfer of financial messaging data from the EU to the US for purposes of its terrorist finance tracking programme.

This follows the European Parliament's refusal to approve the agreement (see summary dated 11/02/2010).

The EU/US agreement on the processing and the transfer of financial messaging data was signed on 30 November 2009.

Following the entry into force of the Treaty of Lisbon on 1 December 2009, the Council can only adopt a decision to conclude such an agreement after obtaining the consent of the European Parliament .

The European Parliament adopted by 378 votes to 196, with 31 abstentions, a legislative resolution in which it withheld consent to the conclusion of the Agreement between the EU and the USA on the processing and transfer of Financial Messaging Data from the European Union to the United States for purposes of the Terrorist Finance Tracking Program (TFTP).

It requested the European Commission to immediately submit recommendations to the Council with a view to a long-term agreement with the United States dealing with the prevention of terrorism financing.

It also reiterated that any new agreement in this area should comply with the new legal framework established by the Treaty of Lisbon and the now binding Charter of Fundamental Rights of the European Union, and renewed the requests made in its resolution of 17 September 2009, particularly in paragraphs 7 to 13 (please refer to RSP/2009/2670 ).

The resolution of September 2009 requested the Council and the Commission to confirm that batches and large files such as those concerning transactions relating to the Single European Payment Area (SEPA) would fall outside the scope of the data to be requested by or transferred to the US Treasury Department. It also underlined the importance of legal certainty and immunity for citizens and private organisations subject to data transfers under such arrangements as the proposed EU-US agreement.

In that resolution, Parliament also noted that it might be useful for the Commission to evaluate the necessity of setting up a European TFTP, and requested the Commission and the Presidency to ensure that the European Parliament and all national parliaments would be given full access to the negotiation documents and directives.

It should be noted that, notwithstanding the signature of the TFTP agreement by the parties, Parliament’s refusal to give consent to the agreement deprives it of any legal effect; therefore it cannot enter into force.

Following the vote on 4 February 2010 by the LIBE Committee on the TFTP Agreement, the Spanish Presidency proposes this draft declaration:

· in June 2009 the Commission presented draft negotiation guidelines for a short-term TFTP Agreement to the Council. At the end of July 2009, the Council adopted negotiation guidelines for such an Agreement, knowing that in the absence of such short-term Agreement an important security gap would arise in which there would be a risk of losing the benefit of important leads obtained through the Terrorist Finance Tracking Programme from European financial transactions for future terrorism investigations;

· as SWIFT had clearly indicated that it would redesign its database at the latest by the end of 2009, it was impossible to wait for the entry into force of the Lisbon Treaty before starting the negotiations for such Agreement. The important value of the TFTP, a United States Treasury Department counter-terrorism programme, for Member States' investigation and disruption of terrorism has been amply demonstrated, including in the second Bruguière Report which was provided to the European Parliament on 1 February 2010;

· being aware of the entry into force of the Lisbon Treaty, the Council, when authorising the signing of the Agreement with the United States on the processing and transfer of financial messaging data for the purposes of the Terrorist Finance Tracking Programme ("TFTP"), decided that the Agreement should have a transitional nature and should be applicable only for a very short term, having a maximum duration of nine months. This period is even shorter than the maximum of twelve months that was called for in the European Parliament's Resolution of 17 September 2009;

· the Council would also like to point out that the short term Agreement already contains an important number of the guarantees which were called for in the European Parliament's Resolution of 17 September 2009, as it was requested during negotiation by Member States. The demands for a judicial authorisation as well as for a "push" system are also being complied with by the current short-term Agreement. The Agreement also clearly prohibits the use of any SWIFT data for purposes other than that those linked to the financing of terrorism. The short-term Agreement is, as the Parliament had asked for, based on the 2003 EU-US Mutual Legal Assistance Agreement, and at the same time provides for a significantly higher level of data protection than the 2003 Agreement;

· as regards the longer term EU-US TFTP Agreement , the Council shares the Parliament's concerns regarding the need to strike the right balance between security measures and the protection of civil liberties and fundamental rights, while ensuring the utmost respect for privacy and data protection.

The Council calls on the Commission to adopt in February draft negotiation guidelines that fully take into account those concerns.. The Council is of the opinion that a longer-term Agreement should contain strong guarantees concerning the deletion of data and greater specificity regarding the sharing of TFTP-derived information with national authorities and third countries. The significant data protection safeguards already set out in the short term agreement, such as the strict purpose limitation and the absolute prohibition on data mining, will also feature prominently in any future TFTP Agreement.

The Council is looking forward to the new situation which has been created by the Lisbon Treaty and to work together with the Parliament, which needs to be informed fully and immediately at all stages of the procedure. This will allow the Parliament to fully exercise its role provided in the Treaty, in order to achieve that the longer term TFTP Agreement meets it's concerns regarding the protection of personal data, while ensuring that the TFTP can continue to provide EU Member States with significant lead information to investigate and disrupt terrorism.

The Council understands the need of the European Parliament to have easier access to the classified parts of international Agreements in order to carry out its assessment. In that perspective the Council commits itself to negotiate an inter-institutional Agreement with the Parliament on the sharing of classified information.

Further to Coreper’s discussion on the Agreement between the European Union and the United States of America on the Processing and Transfer of Financial Messaging Data for Purposes of the Terrorist Finance Tracking Program, a “declassified” document was published and presented to the delegations.

This document comprises an annex which shall be an integral part of the abovementioned Agreement.

Pursuant to Article 3 of the Agreement, the Parties herewith jointly designate as a provider of international financial payment messaging services for the purposes of the Agreement:

· the Society for Worldwide Interbank Financial Telecommunication, a limited liability co-operative society ( S.W.I.F.T. SCRL.) incorporated in Brussels, Belgium on 3 May 1973, with its registered office at Avenue Adèle 1, B-1310 La Hulpe, Belgium.

The Parties agree that so-called SEPA (Single European Payment Area) data shall not be requested from S.W.I.F.T. SCRL. under the Agreement.

This Annex may be amended where agreed upon by the Parties by exchange of diplomatic notes.

The Committee on Civil Liberties, Justice and Home Affairs adopted the report by Jeanine HENNIS-PLASSCHAERT (ALDE, NL) recommending that Parliament withhold its consent to the conclusion of the interim Agreement between the EU and the USA on the processing and transfer of Financial Messaging Data from the EU to the USA for purposes of the Terrorist Finance Tracking Program.

The report adopted in committee called on the Commission to submit immediately recommendations to the Council with a view to a long-term agreement with the USA dealing with the prevention of terrorism financing, and stressed that any new agreement in this area should comply with the new legal framework established by the Treaty of Lisbon and the now binding EU Charter of Fundamental Rights. It also renewed the requests made in the resolution adopted by Parliament on 17 September 2009, particularly in paragraphs 7 to 13 (see procedure file 2009/2670(RSP) ).

Background

After the terrorist attacks of 11 September 2001, the US Treasury developed the 'Terrorist Finance Tracking Program' (TFTP) under which it subpoenaed the Belgian-based SWIFT company, a secure messaging provider for financial transactions, to get access to bank transactions. SWIFT handles 80% of the world's electronic financial transfers, including those by most of Europe's banks.

SWIFT's cooperation with the US Treasury programme was disclosed in the press in 2006 and caused a furore. Following demands from European data protection authorities that EU privacy laws should not be violated, an agreement was signed in 2007.

Until recently, SWIFT stored messages on two identical ("mirror") servers, located in Europe and the USA. However, it decided to make changes in its structure and announced that, as from January 2010, intra-EU message data would be exclusively processed and stored within Europe. This new architecture - which would have shut off US access to much of the SWIFT data it received under the former messaging architecture - led to a request from the US to the Council to negotiate a fresh EU-US agreement on the processing and transfer of financial messaging data for the purposes of the US Terrorist and Finance Tracking Program. On 30 November 2009 the Council signed an interim agreement with the USA, which would provisionally be applied as from 1 February 2010 and expire on 31 October 2010.

Under the provisions of the Lisbon Treaty, the European Parliament's consent to the formal conclusion of this interim agreement is required. The withholding of consent would render the agreement legally void.

PURPOSE: to conclude the Agreement between the EU and the United States of America on the processing and transfer of Financial Messaging Data from the EU to the US for purposes of the Terrorist Finance Tracking Program.

PROPOSED ACT: Council Decision.

CONTENT: the Agreement between the EU and the US the processing and transfer of Financial Messaging Data for purposes of the Terrorist Finance Tracking Program was signed on 30 November 2009, subject to its conclusion at a later date.

The provisions of the Agreement will apply provisionally from 1 February 2010 until its entry into force.

Territorial application : the UK and Ireland will take part in the adoption of the Decision. Denmark will not be bound by the Agreement.

Following the entry into force of the Treaty of Lisbon on 1 December 2009, the procedures to be followed to conclude the Agreement are governed by Article 218 of the Treaty on the Functioning of the EU.

PURPOSE: to conclude the Agreement between the EU and the United States of America on the processing and transfer of Financial Messaging Data from the EU to the US for purposes of the Terrorist Finance Tracking Program.

PROPOSED ACT: Council Decision.

CONTENT: the Agreement between the EU and the US the processing and transfer of Financial Messaging Data for purposes of the Terrorist Finance Tracking Program was signed on 30 November 2009, subject to its conclusion at a later date.

The provisions of the Agreement will apply provisionally from 1 February 2010 until its entry into force.

Territorial application : the UK and Ireland will take part in the adoption of the Decision. Denmark will not be bound by the Agreement.

Following the entry into force of the Treaty of Lisbon on 1 December 2009, the procedures to be followed to conclude the Agreement are governed by Article 218 of the Treaty on the Functioning of the EU.

This document contains a draft Council Decision on the signing, on behalf of the EU, of the Agreement between the EU and the USA on the processing and transfer of Financial Messaging Data from the EU to the USA for purposes of the Terrorist Finance Tracking Program (TFTP).

The main contents of the Agreement are as follows:

Purpose of Agreement : the purpose of this Agreement is to ensure, with full respect for the privacy, protection of personal data, and other conditions set out in this Agreement, that:

a) financial payment messaging and related data stored in the territory of the EU by providers of international financial payment messaging services, that are jointly designated pursuant to the Agreement, are made available upon request by the U.S. Treasury Department for the purpose of the prevention, investigation, detection, or prosecution of terrorism or terrorist financing; and

b) relevant information obtained through the TFTP is made available to law enforcement, public security, or counter terrorism authorities of Member States, or Europol or Eurojust, for the purpose of the prevention, investigation, detection, or prosecution of terrorism or terrorist financing.

Data concerned : this Agreement applies to the obtaining and use of financial payment messaging and related data with a view to the prevention, investigation, detection, or prosecution of acts of a person or entity that involve violence, or are otherwise dangerous to human life or create a risk of damage to property or infrastructure, and which, given their nature and context, are reasonably believed to be committed with the aim of:

· intimidating or coercing a population;

· intimidating, compelling, or coercing a government or international organisation to act or abstain from acting; or

· seriously destabilizing or destroying the fundamental political, constitutional, economic, or social structures of a country or an international organisation.

Ensuring Provision of Data by Designated Providers : the EU must ensure that entities jointly designated by the Parties as providers of international financial payment messaging services ("Designated Providers") make available to the U.S. Treasury Department requested financial payment messaging and related data for the purpose of the prevention, investigation, detection, or prosecution of terrorism or terrorist financing ("Provided Data").

U.S. Requests to Obtain Data from Designated Providers : the U.S. Treasury Department will issue a request based on an ongoing investigation concerning a specific conduct referred to in the clause regarding conduct pertaining to terrorism or terrorist financing that has been committed or where there is a reason to believe that it could be committed. The request shall identify as clearly as possible data stored by a Designated Provider in the EU that are necessary to this end. Data may include identifying information about the originator and/or recipient of the transaction, including name, account number, address, national identification number, and other personal data related to financial messages. The request shall substantiate the necessity for the data and shall be tailored as narrowly as possible in order to minimize the amount of data requested, taking due account of geographic, threat and vulnerability analyses. The request will be transmitted by the U.S. Department of Justice to the central authority of the Member State either in which the Designated Provider is based or where it stores the requested data. The US will simultaneously transmit a copy of the request to the central authority of the other Member State , and also simultaneously transmit a copy of the request to the national members of Eurojust of those Member States. The request will be transmitted to the competent authority for its execution under the law of the requested Member State . The requested measure shall be executed as a matter of urgency. If the Designated Provider is not able to produce the specific data that would respond to the request because of technical reasons, all potentially relevant data shall be transmitted in bulk, subject to provisions here on safeguards applicable to the processing of provided data, to the competent authority of the requested Member State. The data that have been transmitted lawfully on the basis of this provision may be searched for the purpose of other investigations concerning the types of conduct covered by the Agreement with full respect for the safeguards.

Safeguards Applicable to the Processing of Provided Data : the U.S. Treasury Department shall ensure that Provided Data are processed in accordance with the provisions of this Agreement. The Agreement provides that the TFTP does not and shall not involve data mining or any other type of algorithmic or automated profiling or computer filtering. The U.S. Treasury Department shall ensure the protection of personal data by means of the 13 safeguards, described in the text, which shall be applied without discrimination, in particular on the basis of nationality or country of residence. These safeguards include the provision that all non-extracted data received prior to 20 July 2007 shall be deleted not later than five years after that date, and all non-extracted data received on or after 20 July 2007 shall be deleted not later than five years from receipt; subject to conditions.

Adequacy : subject to ongoing compliance with the commitments on privacy and protection of personal data, the U.S. Treasury Department is deemed to ensure an adequate level of data protection for the processing of financial payment messaging and related data transferred from the EU to the US. .

Spontaneous Provision of Information : the U.S. Treasury Department shall ensure the availability to law enforcement authorities of concerned Member States, and to Europol within the remit of its mandate, of information obtained through the TFTP that may contribute to the prevention, of terrorism in the EU or its financing. Any follow-on information that may contribute to the prevention of terrorism in the USA shall be conveyed back to the US on a reciprocal basis.

EU Requests for TFTP Searches : where a law enforcement authority of a Member State, or Europol or Eurojust, determines that there is reason to believe that a person or entity has a nexus to terrorism, such authority may request a search for relevant information obtained through the TFTP. The U.S. Treasury Department shall promptly conduct a search and provide relevant information in response to such requests. There are provisions in the Agreement for cooperation with future equivalent EU system.

Joint Review : this will normally take place after a period of six months of the implementation of this Agreement with particular regard to verifying the privacy, protection of personal data, and reciprocity provisions, and include a proportionality assessment of the Provided Data, based on the value of such data for the investigation, prevention, detection, or prosecution of terrorism or its financing.

Redress : any person has the right to obtain, following requests made at reasonable intervals, without constraint and without excessive delay or expense, confirmation from his or her data protection authority whether all necessary verifications have taken place within the EU to ensure that his or her data protection rights have been respected in compliance with the Agreement, and, in particular, whether any processing of his or her personal data has taken place in breach of this Agreement. Such right may be subject to necessary and proportionate measures applicable under national law, including for the protection of public security or national security or to avoid prejudicing the prevention, detection, investigation, or prosecution of criminal offences, with due regard for the legitimate interest of the person concerned. Any person who considers his or her personal data to have been processed in breach of the Agreement is entitled to seek effective administrative and judicial redress in accordance with the laws of the EU, its Member States, and the US, respectively.

The Agreement contains clauses on consultation, non-derogation and termination . Its duration is from 1 February 2010 to 31 October 2010.

As soon as the Treaty of Lisbon enters into force, the Parties will endeavour to conclude a long-term agreement to succeed the Agreement.