Agreement between the European Union and the United States on the transfer of financial messaging data

KEY POINTS

• To obtain the necessary data from the EU, the US Treasury Department makes a request, and sends any additional documents, to a designated provider in the US. At the same time, it sends a copy of these documents to Europol, which checks that the request complies with the requirements of the agreement and notifies the designated provider accordingly. Once the compliance of the request is confirmed, it will have binding legal effect and the designated provider is required to transfer the requested data to the US Treasury Department.
• The US Treasury Department must ensure that certain safeguards, particularly in relation to the protection of personal data, are applied when the data provided are processed. The data may only be processed for the purpose of preventing, investigating, detecting or prosecuting terrorism or terrorist financing. It must be secured from unauthorised access, disclosure and loss, as well as from any unauthorised form of processing. A search of the data provided may only be carried out where there is pre-existing information or evidence indicating that the subject of the search might be connected to terrorism or its financing. All searches and the reasons for them must be recorded.
• The US Treasury Department must delete non-extracted data:
  • no longer necessary for the fight against terrorism, based on (at least) an annual evaluation;
  • transmitted without having been requested;
  • by 20 July 2012 at the latest, if it was received before 20 July 2007;
  • no later than 5 years after receipt, if it was received after 20 July 2007.
• Extracted data may be retained for only as long as is necessary to fulfil the purpose for which it was requested. The agreement also defines safeguards to limit the onward transfers of extracted data.
• The US Treasury Department must make information from the TFTP that may contribute to the EU’s actions against terrorism available to the relevant authorities of the EU countries concerned and, as appropriate, to Europol and Eurojust. Similarly, if any additional information is thought to be necessary to the US’s fight against terrorism, it must be conveyed back. To facilitate these exchanges of information, a Europol liaison officer may be delegated to the US Treasury Department.
• A relevant EU national authority, Europol or Eurojust may ask US Treasury Department to search data acquired through the TFTP and to transfer relevant information if there is reason to believe that a person or entity is connected to terrorism or its financing as defined by Directive (EU) 2017/541 on combating terrorism and Directive (EU) 2015/849 on the prevention of the use of the financial system for money laundering.
• During the term of the agreement, the European Commission is to examine the options available for establishing an EU system equivalent to that of the US TFTP. Once a European system is established, there will be the need to review and possibly modify this agreement and ensure the systems are complementary.
• Independent overseers monitor compliance with the limitations and safeguards of the agreement. They have the authority to review, query and block searches of data provided, as well as to request additional justifications on the connection to terrorism. One of these overseers is appointed by the Commission.
• Via the national data protection authority, a person has the right to request confirmation that his or her personal data have been processed in compliance with data protection rights under Directive (EU) 2016/680 on protecting personal data when being used by police and criminal justice authorities. Disclosure of this information may be refused or restricted if necessary for the fight against terrorism or the protection of public or national security. In such cases, a written explanation will be given to the person, together with information on the possibility to seek administrative and judicial redress in the US. A person also has the right to request the rectification, erasure or blocking of inaccurate or wrongly processed personal data. To maintain the accuracy of information received or transmitted under this agreement, the data may be supplemented, deleted or corrected by each party. The US Treasury Department provides information on the TFTP on a public website, including on the right of redress.