The European Commission announced in March 2008, a review on behalf of the European Union in respect of the procedures governing the handling, use, and dissemination of financial transaction records from the EU which are carried over the SWIFT network and obtained by the U.S. Treasury Department pursuant to subpoenas issued in support of the Terrorist Finance Tracking Programme (TFTP). Judge Bruguière, designated by the European Commission to undertake the review, prepared a first report to Vice-President Barrot.

The Report put forward by Judge Bruguière demonstrates that the United States Treasury Department has implemented significant and effective controls and safeguards which ensure respect for the protection of personal data subpoenaed for the purpose of the Terrorist Finance Tracking Programme (TFTP). Following his review of the TFTP and its surrounding privacy-related safeguards, Judge Bruguière formulated a series of recommendations to ensure that these measures are continued and, where possible, enhanced.

The review focused particular attention on the core undertakings set out in the TFTP Representations, namely:

• That SWIFT data are used exclusively for counter terrorism purposes.
• That the Treasury ensures that subpoenas are narrowly focused.
• That searches against the TFTP database are targeted and designed to minimise extraction of data.
• That appropriate measures are in place to identify and delete data which are no longer considered necessary for the fight against terrorism.
• That necessary physical and logical systems exist to ensure the security of subpoenaed data.

Having access to discussions with the Treasury Department, Judge Bruguière concluded that the TFTP has generated since its implementation and continues to generate, significant value for the fight against terrorism in the United States, in Europe and beyond.

The TFTP Representations allow the Commission to designate an "eminent European person" to assess whether the U.S. Treasury Department is implementing the TFTP in accordance with its Representations. The Commission announced the designation of Judge Bruguière for this purpose in March 2008.

It had to be confirmed whether the TFTP is implemented consistent with the Treasury Department’s representations for the purpose of verifying the protection of EU-originating personal data. The TFTP Representations state that an annual report will be delivered to the European Commission which in turn will present the findings of the report to the European Parliament and Council.

Vice-President Barrot, in charge of Justice, Liberty and Security, who presented this year's report findings to the European Parliament's Civil Liberties Committee confirmed “that the United States Treasury Department has been vigilant from the outset in respecting the safeguards in the handling of personal data included in the TFTP Representations which we were able to negotiate with them back in 2007 and notably the strict counter terrorism purpose limitation. The TFTP has generated significant value in the fight against terrorism, notably in Europe".

The European Union has been extremely vigilant as to preserve privacy issues in cross-border cooperation between Member States in fighting against crime and terrorism. This approach is also to be present in those cases related to EU and US cooperation in fighting terrorism where privacy issues might be at stake, and therefore the Commission's annual report on TFTP aims to ensure this commitment.

Terrorist Finance Tracking Programme (TFTP) Representations

After the September 11th 2001 terrorist attacks the U.S. Treasury Department developed the Terrorist Finance Tracking Programme (TFTP) for the investigation, prevention and prosecution of terrorism. Under the TFTP the Treasury Department has served administrative subpoenas on the Society for Worldwide Interbank Financial Telecommunication (SWIFT). These subpoenas require SWIFT in the U.S. to transfer a limited subset of message data held on its U.S. server to the Treasury Department where they may be used for counter terrorism purposes regarding suspected individuals or entities.

Based on intelligence that identifies an individual or entity, the US Government is able to conduct targeted searches of the limited subset of records provided by SWIFT in order to trace financial transactions of suspected terrorist activity.

In June 2007 the Treasury Department gave a set of unilateral commitments, "TFTP Representations", to the European Union regarding the controls and safeguards governing the handling, use and dissemination of data under the TFTP. The Representations address EU data protection concerns and were published in the Official Journal in July 2007, and in the U.S. Federal Register in October 2007.