An EU working party looking into the SWIFT – US financial transaction privacy scandal has found that all European banks using the SWIFT service must inform clients that US authorities could be given access to their personal, banking and financial data as a result.

The so called “Article 29 Working Party” also found that any European bank using the Society for Worldwide Interbank Financial Telecom-

munication (SWIFT) for financial transactions also shares culpability, to varying degrees, for the wide-scale compromising of personal data and banking details.

Belgium-based SWIFT is a worldwide financial messaging service that facilitates international money transfers. Millions of European banking transaction records, including Maltese, on the SWIFT database were found to have been secretly passed over earlier this year to US intelligence agencies – specifically the US Treasury Department (UST) and the Central Intelligence Agency – since 2001.

The Article 29 Working Party found in its report published Thursday that “All financial institutions in the EU using the SWIFT service, including the Central Banks, have to make sure that their clients are properly informed about how their personal data are processed and which rights the data subjects have.” The working party represents the EU’s national data protection commissions and Malta’s commissioner is a member.

The working party added, “They also have to give information that US authorities might have access to such data.

“Data protection supervisory authorities will enforce these requirements in order to guarantee that they are met by all financial institutions on a European level and they will cooperate on harmonised information notices.”

In its long-awaited report on an issue that has become yet another thorn in the side of EU-US relations, the Party concluded that “the hidden, systematic, massive and long-term transfer of personal data by SWIFT to the UST in a confidential, non-transparent and systematic manner for years without effective legal grounds and without the possibility of independent control by public data protection supervisory authorities, constitutes a violation of fundamental European principles as regards data protection and is not in accordance with Belgian and European law”.

It concluded that the lack of transparency and adequate, effective control mechanisms surrounding the entire process of transferring personal data first to the US and then to the UST “represents a serious breach in light of the Directive. In addition, the guarantees for the transfer of data to a third country as defined by the Directive and the principles of proportionality and necessity are violated”.

The Working Party found that SWIFT bears primary responsibility and financial institutions bearing some responsibility for the processing of their clients’ personal data.

“The financial institutions are responsible for having sufficient knowledge of the different payment systems and their technical and legal characteristics and risks. If financial institutions did not strive (sufficiently) to obtain such knowledge, they would accept substantial legal and client risks in breach of their fundamental duty of care,” the report added.