Hands off our bank data, Europe tells US
274
Secret subpoenas threaten stability - EC Exclusive The European Commission is set to call for an immediate halt on the illegal transfer of financial information to the United States Treasury.â¦
251253
(InfoWorld) - Executives from the financial data transfer company Swift and the president of the European Central Bank (ECB) faced tough questions in a European Parliament committee meeting Wednesday, about the illegal sharing of private data with U.S. authorities. ECB chief Jean-Claude Trichet denied that the bank should have stepped in to prevent the breach of European data protection laws, saying that the bank could only advise the Society for Worldwide Interbank Financial Telecommunication SCRL (Swift). "We have no judicial competence in the field of data protection," he said. Swift's Chief Financial Officer Francis van Bever explained that the company has two information storage facilities, one in the U.S. and the other in Holland. Each facility holds identical data: they serve as back-ups for each other in case one were to crash. "Each facility is subject to local laws," Van Bever said. "We were obliged to respond to the subpoena from the U.S. authorities." European law is unclear, he said, adding that after getting external legal advice in Belgium, Swift concluded that transferring the data to the U.S. authorities would be legal. "We didn't check with local data protection authorities because we thought what we were doing was legal," he said. U.S. agencies ordered Swift to share millions of pieces of information about people and companies from around the world in the wake of the terrorist attacks on Sept. 11, 2001. The information was deemed essential in tracing the financing of terrorism, and Swift complied with the order. However, European data protection laws forbid transfers of European citizens' personal data outside the E.U. if the country receiving the data has aÂ weaker data protection regimeÂ than Europe's. The U.S. is considered such a country under European laws. In June the New York Times revealed that Swift has been sharing the data with U.S. authorities for years, sparking investigations in Europe into how the European laws could so easily have been breached. Last week, Belgium's privacy commission concluded a two-month investigation, accusing Swift of breaking Belgian and Europe-wide data protection laws. However, it stopped short of proposing fines for the company, which it agreed was caught between conflicting legal requirements on each side of the Atlantic. Many European parliamentarians drew a parallel between the Swift case and the ongoing attempts to strike a data sharing agreement that would allow the U.S. authorities access to personal data about passengers flying to the U.S.. They were unimpressed by what more than one member of the European parliament referred to as "buck-passing" when it came to handing out responsibility for the data protection breach. Trichet tried to move the debate beyond casting blame by suggesting ways of avoiding similar problems in future. "This problem is ongoing," he said. "The system we have in place is imperfect. It is very important to clarify the situation and work out what to do about such data transfers across the Atlantic." He added that any agreement between the E.U. and the U.S. should then form the basis for a global solution, because the problem is worldwide. "We need a global legal framework for situations like this," Trichet said. Swift's van Bever agreed. "We would welcome such clarification," he said, adding that the double taxation treaty could be a role model. The treaty is signed by many countries around the world and is designed to prevent people being taxed twice on the same income by different tax authorities.
184172
U.S. Treasury officials will be able to keep data on financial transactions collected in anti-terror investigations for only five years under a deal with the EU to safeguard privacy rights, EU officials said Thursday.
744812
(InfoWorld) - European data-protection officials are broadening their investigation into the alleged transfer of personal banking details by the Swift banking cooperative in Belgium to U.S. authorities, the European Commission said Wednesday.Separately, the Belgian data-protection authority is expected to conclude its report into the affair in the coming weeks. Unlike the European officials, the Belgian authorities could impose sanctions on Swift, a banking industry payment-transfer organization."Recognising the seriousness of the questions that have been raised, the working party agreed to continue fact-finding and conduct further analysis based on all relevant factual and legal elements," the Commission said in a statement, referring to a working party of data-protection officials from around the European Union. The group met in Brussels Tuesday and Wednesday."The working party's priority is to safeguard European data protection rights," the Commission said.The officials will conclude their investigation in November at their next meeting, the Commission said. If they find that European data protection laws have been violated they could propose that the Commission take legal action against Belgium for failing to uphold Union-wide laws.In the statement, the Commission said the officials expressed "immediate concerns about the lack of transparency" surrounding the transfers, which began in secret shortly after the Sept. 11, 2001, terrorist attacks on the U.S.The transfers, which came to light in newspaper reports in June this year, have raised fears that Swift has abused European citizensâ privacy. The U.S. Central Intelligence Agency and other U.S. intelligence agencies allegedly demanded the information in order to trace terrorist financing activity.The so-called Swift affair comes at a time of heightened tension between Europe and the U.S. over how to balance counter-terrorism needs and preserve citizens' civil liberties. Last month U.S. President George Bush admitted that terrorism suspects have been secretly detained in Europe, sparking an angry outcry among European civil liberties groups, politicians and newspapers.
333215
A report by an EU panel released Thursday said the bank data transfer agency SWIFT broke European privacy laws by handing over personal data to U.S. authorities for use in anti-terror investigations.
694508
(InfoWorld) - In the five years since terrorists attacked the U.S., Europe has been the target of extremist attacks, as has India. Bombings in London and Madrid and a recent failed attempt to blow up passenger trains in Germany have prompted a security clampdown never seen on the Continent. Throughout the European Union, governments are grappling with how to guard against terrorist attacks. Meanwhile, Indian IT services companies have beefed up efforts to protect data. The discovery of bombs in two German trains in July pushed up several security measures on the political agenda there. In September, the German government agreed to a new antiterror database, which will be available to authorities across the country and contain information such as a person's religion, travel history, telephone number and Internet data and bank details. It also approved increased use of video surveillance in public areas. These measures reflect a gigantic shift in thinking about privacy in Germany, which has been highly sensitive about data protection and surveillance because of its Nazi history and, more recently, the Stasi secret police in the former communist-run East Germany. The need to tighten security has created demand for new technologies to help authorities combat terrorism. The German subsidiary of IBM Corp., for instance, is working on new technology that will enable computers -- not human beings -- to filter information from the cameras monitoring public areas and other locations. Two German companies have developed a new biometric system for identifying airline passengers. Lufthansa Systems Group GmbH, the IT services arm of German airline Lufthansa AG, and high-security document producer Bundesdruckerei GmbH have developed the SecBoard system. The companies hope that the system, designed to conduct biometric checks on passengers prior to boarding an aircraft, will play a significant role in "trusted passenger" programs planned by the airline industry to increase security. In the U.K., the government is close to activating part of the Regulation of Investigatory Powers Act (RIPA) of 2000 that deals with encrypted data, one in a set of powers covering electronic surveillance and wiretapping. Authorities say the increased use of encryption is hampering their access to information on suspectsâ computers. RIPA would allow police to demand that a suspect decrypt data or face up to two years in jail. The encryption measure in RIPA has remained dormant since the techniques werenât widely used when the law was passed, according to the U.K. Home Office. Terrorist suspects already face up to five years for failing to decrypt data or provide an encryption key. But critics contend the law, which would apply in more than terrorism-related investigations, gives too much power to law enforcement and has the potential for abuse. High-ranking officials could demand the decryption of data without a court order, and the law binds to secrecy those served with a request. Experts say the law could increase the chance that, if seized, a companyâs mission-critical data could be mishandled. Elsewhere in Europe, heads of state met to discuss 57 antiterrorism measures two weeks after the March 11, 2004 bombings of four crowded commuter trains in Madrid. Among the measures discussed were the surveillance of telecommunications, Internet communications and air transportation. Civil liberties groups accused them of using the fight against terrorism as an excuse to increase police powers. E.U. legislation was slow to follow but, from September 2007, telecom carriers and ISPs (Internet service providers) must keep data on all mobile and fixed-line calls for between six months and two years. From March 2009, they must keep data on VOIP (voice over Internet Protocol) calls, Internet connections and e-mail messages. Law enforcement officials will be able to demand the date and time of calls and messages, but not their content, and identifying information of the calling or sending and receiving parties. In India, the Sept. 11 attacks were not a watershed event because the country experienced frequent attacks by Kashmiri separatist groups demanding independence. Even before Sept. 11, some of the large Indian IT services companies had hardened data centers supporting their offshore businesses, said T. R. Madan Mohan, an analyst at Frost & Sullivan Inc. After Web sites of a ministry of the Indian government and an Indian atomic energy agency were hacked, and anti-India messages posted on these sites, Indian businesses showed increased concern about the need for intrusion detection and related security measures, he added. Infosys Technologies Ltd., Indiaâs second largest outsourcer, already had disaster recovery and business continuity plans in place before Sept. 11, said a spokeswoman for the company in Bangalore. However, those attacks brought the threat of terrorism into sharp focus for Indiaâs export-oriented industries, such as software outsourcing, because U.S. and European customers began worrying about the preparedness of their Indian suppliers for terrorist attacks. (Reported and written by John Blau in Dusseldorf, Germany; Peter Sayer in Paris; Jeremy Kirk in London; and John Ribeiro in Bangalore, India, and assembled by Grant Gross in Washington, D.C.)
246174
An independent panel has alleged that the bank data-clearing agency SWIFT broke European privacy laws by giving the U.S. records of financial transfers to help anti-terrorism investigations, according to a news report Wednesday.
389678
The head of the U.K. National Health Service has defended plans to build a centralized database of patient records following another embarrassing loss of personal information by the government.The U.K. Department of Health admitted this weekend that nine of its regional NHS trusts have reported losing patient data. One of the trusts, the City and Hackney Primary Care Trust, in east London, lost the medical records for about 160,000 children, according to newspaper reports. The total number of records has not been disclosed.The losses emerged as part of a wider review following similar government blunders, and have revived questions about the security of building a centralized patient records database, part of the U.K.&#39;s National Programme for IT (NPfIT). But David Nicholson, chief executive of the NHS, said the project is essential and should go ahead.&quot;It&#39;s vitally important that when a doctor is sitting in front of a patient they have all the information they need at their fingertips, and that&#39;s what&#39;s been driving us through all this,&quot; Nicholson told BBC Radio 4&#39;s Today program on Monday.The proposed system will not be a single large records database, but a series of interconnected regional databases, he said. And the security system will be more rigorous than that used with most Internet banking systems, according to Nicholson.&quot;You&#39;d need a user name, a password and a smart card [to access patient records] and you would have role-controlled access,&quot; he said. &quot;So a nurse on a ward with a smart card and a password could only access a relatively small number of patient records.&quot;The information that was reported lost over the weekend was encrypted and so not vulnerable to misuse, Nicholson said.But Ross Anderson, a security expert at the University of Cambridge, told Radio 4 that whether the data is encrypted is not the main issue.&quot;One of the questions you have to ask here is not whether the data was encrypted or password protected, but why someone was able to have access to 160,000 children&#39;s records,&quot; he said. &quot;In private industry ... if someone tried to make off with hundreds of thousands of records the alarms would sound.&quot;Opposition leaders pounced on the latest misstep as evidence that the Labour government can&#39;t be trusted with its citizens&#39; data. They called for further studies to show how the proposed patient records system would protect privacy.The incident comes after the U.K.&#39;s HM Revenue and Customs lost personal records for 25 million Britons, and the Driving Standards Agency lost records for more than 3 million learner drivers.&quot;The power of technology means it can be very easy to use the information, but also very easy to lose the information,&quot; the Information Commissioner Richard Thomas said on the Today program. &quot;The events of the last few weeks have woken up everybody to the importance of taking these matters seriously.&quot;&#160;
189618
Called to account over post-9/11 snooping The European Central Bank (ECB) knew the US was conducting a secret probe of the world's private financial records without official oversight but failed to tell privacy authorities.â¦
533067
Denies responsibility for past intrusions The European Central Bank has put its weight behind transatlantic talks that the EU hopes will secure the privacy of European citizens from the prying eyes of US anti-terrorist investigators.â¦
425944
HM Revenue and Customs (HMRC) is to press private banks to hand over details of their offshore accounts.
183414
UK lays down...proposals The UK has proposed a transatlantic arrangement for sharing biometric data about travellers as US coalition countries in the "war on terror" push for a global system to control migration.â¦
357846
Europe&#39;s top data protection official, European Data Protection Supervisor Peter Hustinx, criticized plans to create a European equivalent of the PNR (passenger name records) gathered by U.S. authorities, questioning the plan&#39;s necessity and proportionality.
441462
EFF wants to know how data is used The US Government faces a lawsuit demanding information about the controversial programme which forces airlines to disclose information about European travellers to the US.â¦
220980
Security over privacy 'becoming a mantra' Europe's data protection chief has warned Portuguese ministers that fundamental rights to freedom are being abused in the name of security. Portugal takes over the rotating EU Presidency on 1st July.â¦
156238
Wants to rein in war on terror The European Parliament is demanding a say on the computerized front of the US anti-terror war and pressing for a global agreement on inter-government data sharing.â¦
443664
The information commissioner on Wednesday hit out at a number of banks and government departments for &quot;horrifying&quot; breaches of the country&#39;s data protection rules.