TREASURY DISCUSSIONS WITH EU ON SWIFT NARROW KEY

C O N F I D E N T I A L SECTION 01 OF 04 BRUSSELS 001421 SIPDIS NOFORN SIPDIS STATE FOR EUR/ERA FOR WALKER, EB FOR LAMBERT TREASURY FOR FREIS AND PACK E.O. 12958: DECL: 04/18/2017 TAGS: ECON EFIN KTFN PTER EUN SUBJECT: TREASURY DISCUSSIONS WITH EU ON SWIFT NARROW KEY ISSUES REF: BRUSSELS 1038 AND PREVIOUS Classified By: EMIN JOHN SAMMIS FOR REASONS 1.4 (b) AND (d) ¶1. 1. (C/NF) Summary and comment. On April 25, FinCEN Director James Freis, Director General for Justice, Freedom and Security at the European Commission, Jonathan Faull, and Berthold Leber, Deputy Director General at the German Ministry of Finance, continued discussions to resolve EU concerns with respect to SWIFT and Treasury,s Terrorist Finance Tracking Program (TFTP) via DVC. In comments to Treasury,s draft discussion paper of April 13, the EU side proposed that Treasury delete SWIFT data that is not used as part of a counter-terrorism investigation after two years. Freis said that for the US having any data deletion requirement is a concession. He stated that there is no consensus yet in US as to what a reasonable data retention period would be, but that it would need to be much longer than two years. Freis stated that 10 years could possibly be an appropriate period. At Freis, urging, Faull agreed to consult further with EU authorities dealing with financial intelligence to see what they would consider to be a necessary retention period. Both sides acknowledged that failure to agree on data retention has the potential to be a deal breaker and if that is the case the issue might need to be discussed at the upcoming US-EU summit. The EU side also proposed that members of Europol,s Joint Supervisory Body (JSB) verify Treasury,s representation of how data is handled and safeguarded under the TFTP. Freis said that he would have great difficulty in recommending that the JSB be charged with oversight because it is made up of EU data protection officials who would not have the necessary law enforcement and security backgrounds. As an alternative, the EU agreed to draft language to create a joint review mechanism similar to the one in the PNR agreement. Another possibility would be to identify an &eminent person8 to conduct the verification. Faull was not able to provide any further clarification about how the US representations would be taken into account on the EU side. Both sides agreed to work on some new language to resolve the remaining issues and to speak again via conference call on Friday, April 27. ¶2. (C/NF) The overall tone of the DVC was positive and a number of small issues were resolved. Despite the reference to raising SWIFT at the upcoming summit, at this point the main issues (data retention and oversight) seem bridgeable. The more worrying question is lack of EU clarity as to what form the final resolution might take. This is essentially an EU problem tied up in the legal question of whether this is a first pillar (commercial) or third pillar (law enforcement) data transfer. Our sense is that the EU wants to have a deal and so will ultimately come up with a solution. End summary and comment. Data retention ¶3. (C/NF) Freis began the discussion by asking the EU to explain how they had arrived at the proposed two year data retention period. Faull and Leber listed pieces of EU legislation that include various retention periods ) the telecom data retention directive (6 months to 3 years),the EU money laundering directive (5 years) and the wire transfer regulation (5 years). They also cited data retention requirements used by Interpol, Europol and a Council of Europe recommendation regarding data in the police sector. Faull said that given these varying periods the EU considered two years to be fair. Freis responded saying it is not appropriate to compare telecom and financial data. Freis also pointed out the need to distinguish between data retention periods in a multilateral context (such as Europol and Interpol) and periods that are necessary at the primary or national level. Freis said that in his discussions with officials from European financial intelligence units (FIUs) there is a movement to expand data retention periods. From an operational perspective, Freis emphasized that two years is &entirely unreasonable8. Freis indicated that he did not think that European officials would accept a two year retention period and that Faull could have trouble obtaining member state agreement on such a retention period. ¶4. (C/NF) Faull responded saying that they had queried member state law enforcement authorities, but that the answers being provided were not particularly helpful. He said that their answers tended to be that they keep the data for as long as possible in accordance with national law. Faull then asked Freis what he would consider to be a BRUSSELS 00001421 002 OF 004 necessary data retention period. Freis stated that agreement on a data retention period would require consultation with other US agencies and that any deletion requirement would be a concession on the US side. Stressing that there is no consensus yet within the US, Freis indicated that 10 years could possibly be acceptable. Faull agreed to consult further with EU law enforcement authorities that have operational responsibilities on this question. Freis agreed to draft additional language that would explain how Treasury continually refines and narrows its requests for SWIFT data and to provide the criteria used to determine what data can be deleted. ¶5. (C/NF) Both sides acknowledged that failure to agree on data retention periods could mean that we would need to find another way to resolve the issue. It has been understood that the issue would not be raised at the April 30 US-EU summit as long as there is progress towards a resolution. If it seems that a deal is not possible, then Freis and Faull said they would need to flag that for their principals by Friday, April 27. Freis, Faull and Leber agreed to review this issue during a conference call on Friday. Independent oversight ¶6. (C/NF) Freis, first comment on the EU proposal to have Europol,s Joint Supervisory Body (JSB) provide oversight was that this information should be included at the end of the document. Freis explained that the document is a representation of how the TFTP currently operates and this oversight is something that is new and being done to address EU concerns and should come at the end of the document. Faull agreed on this question of placement. ¶7. (C/NF) Turning to substance, Freis confessed that he was surprised and concerned because the JSB is made up of EU data protection authorities (DPAs). Freis said he would have great difficulty in recommending this as a solution. Faull explained that they had proposed the JSB because these are individuals experienced in both data protection as well as law enforcement mattrs. all said that the EU was not necessarily wedde to this solution but that it was a convenientbody that provided the interface between law enforcement and data protection authorities. Gilles de Kerchove from the Council Secretariat noted that if the oversight is done only by the police, they would not have the necessary credibility on the EU side with respect to the data protection issues. Freis said that it would be difficult to accept this solution given that the EU does not yet have agreement on data protection requirements with respect to law enforcement. Freis noted that in general discussions with the DPAs on this issue have been difficult and that involving the JSB would be &throwing us to the wolves8. Leber responded that the Commission needs to address the concerns raised by the Article 29 working party (which is made up of EU member state DPAs) and that probably the Article 29 working party itself would like to take charge of this oversight. ¶8. (C/NF) Freis responded noting that from his perspective the oversight mechanism was meant to address not only the data protection concerns but to also to provide greater operational information sharing. Freis said that if the oversight were to be done by data protection authorities then this operational information sharing objective would not be achieved. Faull agreed that having someone who could both reassure the European Parliament and the public with respect to data protection and increase the national security benefits of the program would be ideal. ¶9. (C/NF) As alternatives to the JSB, Faull proposed either a joint review mechanism that would involve the Commission and member states along the lines of the PNR agreement or an eminent person. Freis indicated that these would likely be more acceptable. Freis flagged that in any case Treasury would need to vet the individual and that this was non-negotiable. Freis suggested adding &in consultation with the US8 for the selection of the individual doing the oversight. ¶10. (C/NF) Regarding the remit of the oversight, Freis said that in principle it was agreed that the purpose of the oversight is to verify compliance by Treasury with the representations. Freis said that he had some concerns with the wording proposed by the EU. For example, Freis explained BRUSSELS 00001421 003 OF 004 that the word &audit8 has specific legal connotations in US law that do not apply in this context. Redress ¶11. (C/NF) Freis stated that it is very difficult to see how redress would work operationally. He explained that there is redress in the US system further downstream in cases in which SWIFT data is used, for example, to designate someone as a terrorist pursuant to UN Security Council Resolutions. If someone feels they have been wrongly designated, there is a redress mechanism. Freis stressed that the SWIFT data is an investigatory tool and as such there is no redress mechanism. Faull countered that there is concern that if there are mistakes in the data, there could be false positives and there needs to be some way to correct that. He also noted that there is nearly agreement in the High Level Contact Group on the right of redress. Mark Monborne, General Counsel from Treasury, noted that real targets of investigations will sometimes makes requests for their information and that it is important to bear this in mind when deciding what information will be provided. Faull indicated that the EU side would look at this issue again understanding that in this case it is difficult to apply the standard redress mechanism. He also said that if the joint review mechanism is used, then the Commission could simply raise any redress questions in the context of the review. General discussion of other EC comments ¶12. (C/NF) Freis asked why the EU had deleted the section of the draft discussion paper on International Counterterrorist Financing Principles. Freis said that he considered this section important in providing to the public the appropriate context for the program. Freis said that this section also illustrates that the US is not operating outside international norms, but rather implementing the norms that have been agreed internationally. Faull said that the section could stay, that it had been taken out simply to shorten and simplify the document. ¶13. (C/NF) Freis also said that he would like to delete references to concerns raised by Canada and within the US. Freis said there are not concerns in the US about the program at this time and it would be inappropriate to include a reference to a third country in this document. Faull agreed. ¶14. (C/NF) Responding to EU proposed text regarding copies of SWIFT data, Freis said that he could agree in principle, but that there should be additional language to cover copies that are made as part of the normal security backup system. Faull agreed that as long as the concept of no copies was retained there was no problem to add language about normal emergency back-up systems. ¶15. (C/NF) Faull explained that MEPs have stressed that data needs to be necessary and not simply useful To address this, throughout the text exchanged &useful8 for &necessary8. Turning to another issue, Freis noted that access to SWIFT data cannot be limited to analysts because occasionally there is a need for other senior officials to see the data. Faull conceded and agreed that language should be found to cover that. ¶16. (C/NF) The EU asked for further precision with respect to the fraction of data that is accessed by Treasury. Freis pushed back, saying that it would be hard to provide a figure and that in any case it is not static. Faull said that the current formulation will generate questions as to what the fraction is. Freis agreed to refine this language. ¶17. (C/NF) The EU added &onward transfers8 to the section entitled dissemination and Freis questioned the meaning of this phrase. Alternatives such as &information sharing8 or &forwarding8 were discussed. Freis said that he would need to look at the language regarding use of the SWIFT information by other US agencies. Freis indicated that it is only for counter-terrorism purposes, but that in some cases the Justice Department charges the individual with other crimes. Freis rejected the EU suggestion to delete the phrase &in the global war on terror8 ¶18. (C/NF) Responding to an EU question, Freis explained that if a person is removed from a US terrorism designation list, that person,s SWIFT-related data would not be deleted. Freis emphasized that under US law, data used in a final BRUSSELS 00001421 004 OF 004 administrative decision to designate an individual will be retained permanently. Freis stressed that this is required under US law and could not be changed as part of these discussions with the EU. Monborne elaborated by saying that removal from the list does not imply that they were wrongly designated or improperly placed on the list in the first place. ¶19. (C/NF) The EU side also added a sentence to say Treasury will print the representations in the Federal Register and agrees to their publication in the EU Official Journal. Monborne noted that as a legal matter, Treasury could not require the FR to publish the representations, but that he did not foresee a problem with publication. He suggested that the language be modified to say that Treasury would endeavor to publish the representations in the FR. Faull agreed and noted that on the EU side there was no problem to commit to publication in the EU,s Official Journal. ¶20. (C/NF) Freis asked Faull if he had any additional information as to how as a legal matter the EU planned to treat the representations. Faull replied that there has been no final determination as to what would be the appropriate legal form. Faull said that the EU would rely on the representations and would consider them as a binding commitment of the USG. Faull did say that there was no expectation that the result would be a treaty. Freis stressed that he would be looking forward to hearing more on this critical point from the EU side. ¶21. (U) This cable has been cleared by Treasury. Gray .