EUROPEAN COMMISSION OUTLINES PNR-STYLE APPROACH TO

C O N F I D E N T I A L SECTION 01 OF 05 BRUSSELS 000253 SIPDIS SIPDIS E.O. 12958: DECL: 01/24/2017 TAGS: PETR KJUST EFIN KTFN PGOV EUN BE SUBJECT: EUROPEAN COMMISSION OUTLINES PNR-STYLE APPROACH TO SWIFT ISSUE REF: A) 06 BRUSSELS 3662 B) 06 BRUSSELS 3301 C) 05 BRUSSELS 4443 Classified By: DCM MCKINLEY FOR REASONS 1.4 (b) AND (d) ¶1. (C/NF) Summary and comment. Treasury Deputy Assistant General Counsel, James Freis, and Michael Jacobson, from Treasury,s Terrorism Finance Office, met with the European Commission, the Council Secretariat and key member states in Brussels to discuss how to resolve the SWIFT issue January 16-18. In December, Commissioner Frattini told the European Parliament that he wanted to negotiate an agreement with the US within the next few months to resolve the data protection issues raised by the Belgian and other European data protection authorities. Jonathan Faull, Director General for Justice, Freedom and Security outlined, for Freis a solution based on the original PNR agreement that would involve three parts: (1) greater disclosure by SWIFT and its participating banks on how the SWIFT system operates; (2) "undertakings" describing how the TFTP and its safeguards work and (3) a legally binding agreement, between the U.S. and the European Commission working on a mandate from the Council. The Commission is preparing a draft for the US to review, but it is unclear when it will be ready. With the exception of the UK and Belgium and possibly a few others, member states are now in a holding pattern waiting to see how the Commission proposes to deal with the issue. There is a serious lack of leadership from the German Presidency, which had not anticipated having to deal with this issue. The European Parliament will be questioning the Commission and the Council at the end of January on PNR and SWIFT issues. ¶2. (C/NF) It is clear that the EU shares our objectives of preserving Treasury,s Terrorist Finance Tracking Program (TFTP) and eliminating the legal uncertainty for SWIFT and the banks. It also appears that some sort of EU-level solution is necessary, as dealing with 27 member states individually would present legal and practical problems. Based on this initial exchange, it seems that we are not very far apart from the Commission on substance but further apart on the method for resolving the issues. The issue is what form we give to the substance and in particular whether an agreement is desirable or needed. While Faull joked about the need for &pillar talk8, the question of whether the issue should be dealt with under pillar 1 or pillar 3 has important implications that should not be underestimated. (For background on the SWIFT issue in the EU see refs A and B. See 05 Brussels 4443 for background on the EU pillar structure) End summary and comment. Septel will report on Freis meetings with Belgian authorities. End summary and comment. Council Secretariat: Need US-EU agreement under pillar 3 ¶3. (C/NF) An initial meeting was held with Gilles de Kerchove, Director for Justice and Home Affairs at the Council Secretariat, who began by providing an overview of recent developments. He said that at the end of last year the Belgians argued in an ECOFIN meeting and a European Council that SWIFT was a European and not just a Belgian issue. The report of the Article 29 working party (which is made up of all the EU data protection authorities) supports this analysis, according to de Kerchove, but he said that not all member states agree. During a meeting of EU Ambassadors on December 20, Frattini stated that it was a collective problem that requires a collective solution. Frattini recommended to member states that there be negotiations with the US. De Kerchove said that one member state ) the UK ) expressed reluctance to see the issue discussed at the EU level. The Commission is now reviewing the issue and will put forward a proposal for the member states that would include various options. ¶4. (C/NF) Turning to the legal questions, de Kerchove explained that SWIFT raises a number of data protection issues. First, SWIFT violated the Belgian data protection directive because they did not notify the data protection authorities that they were &mirroring8 their European database in the US. Because the US is a country that has not been deemed to have adequate data protection, the data transfer should have been notified. De Kerchove described this as &a micro violation of non notification8. Freis noted that the US has encouraged SWIFT to make its notification more transparent. De Kerchove added as a footnote that &informed consent8 (which is one way of complying with the EU data protection directive) as a possible solution would not work because there is no alternative to SWIFT to make payments. ¶5. (C/NF) De Kerchove said that the more serious legal issue was that SWIFT did not notify the data protection BRUSSELS 00000253 002 OF 005 authorities regarding the change in purpose of the data. Freis said that he disagreed fundamentally with the Article 29 working party report regarding the change of purpose. Freis pointed out that all financial institutions have a legal obligation ) including under EU law such as the third money laundering directive ) to screen transactions for counterterrorism and money laundering purposes. Freis indicated that his counterparts in European finance ministries agreed that the Article 29 working party report was incorrect with respect to the change of purpose question and that this conclusion was inconsistent with the working party's allegation of joint liability of the banks and SWIFT. ¶6. (C/NF) In terms of resolving the problem, de Kerchove said that based on the European Court of Justice decision in the PNR case, the SWIFT case ) despite some differences -- falls into the &PNR basket8. This means that the agreement with the US would be based the EU,s third pillar, because the purpose for which the data is used is not a Community objective. De Kerchove said that he had discussed SWIFT with Jonathan Faull, Director General for Justice, Freedom and Security, and they had separately come to the same conclusion that this would require the negotiation of a US-EU agreement. De Kerchove said that without an agreement the Commission would need to start infringement proceedings against Belgium and possibly 26 other member states for not properly applying the EU,s data protection directive. ¶7. (C/NF) Freis responded that the facts in this case are completely different from PNR because the SWIFT data is in the US. Freis said that to simply switch the word &SWIFT8 for &airline8 in the PNR agreement does not work. Freis said that the US could possibly make a public representation about how the data is treated and how it used, but that is very different from a treaty which raises a number of issues on the US side. ¶8. (C/NF) Freis also stressed that he wanted to work with the EU. At the same time, Freis stated clearly that he does not yet know what the result of those discussions would be. In response to a question from de Kerchove, Freis confirmed that the US supported the Belgian proposal for having some sort of European group visit the US. Freis said that the key issue would be who would participate and noted that including data protection authorities would be problematic. ¶9. (C/NF) Freis asked what the EU needed to have legal certainty. De Kerchove admitted that the EU &is in the mist8 following the European Court decision in the PNR case. In the PNR case, because the data is being transferred to the US for a law enforcement purpose, it falls outside the scope of the EU data protection directive and into the EU,s third pillar where the member states ) and not the Commmission ) have competence. Speaking frankly, de Kerchove said that in light of the ECJ decision it is not clear whether the EU,s third money laundering directive or the data retention directive should have been adopted under the EU,s first pillar, because they have a law enforcement objective. He noted that in fact the Irish have challenged the adoption of the data retention directive because they believe it should have been a third and not first pillar instrument. Commission outlines proposal following original PNR agreement ¶10. (C/NF) Faull opened the subsequent main meeting by noting that this was not a negotiation; the Commission has no mandate yet from member states to negotiate. Moreover, the Commission was not seeking to expand its power, but rather to play a positive role towards a solution. Faull stressed that SWIFT is an important issue with counter-terrorism implications as well as implications for the financial system and US-EU relations. Faull said that the situation has created legal uncertainty for SWIFT and that as policy makers, the US and EU should try to help SWIFT. Faull described SWIFT,s behavior as &foolish8 and made clear that SWIFT would have to take steps as well. Faull said that the Commission has no quarrel with what the US does within its own jurisdiction. Faull said that the EU shares the US policy objectives and benefits from the US analysis. Later in the meeting, Faull said that both he and Commissioner Frattini are satisfied that the Treasury,s TFTP benefits the security of the EU. ¶11. (C/NF) Faull stated that an agreement with the US under the EU,s third pillar was required to resolve this problem. Faull argued that this is because the purpose of the data has changed from commercial to counter terrorism purposes. Freis took exception with the analysis. Freis noted that all banks have an obligation to screen transactions to prevent money laundering. Likewise, Freis pointed to the recently BRUSSELS 00000253 003 OF 005 implemented EU regulation on wire transfers to prevent the financing of terrorism. Faull took Freis, points, but said that it did not change the Commission,s analysis that there has been a change in the purpose of the data. ¶12. (C/NF) Faull said that there were three possible ways forward, but only one realistic one. One would be to do nothing and live with the uncertainty and potential legal action against SWIFT in 27 EU member states. The second would be to attempt bilateral agreements with all 27 member states. The Commission's third alternative would be an agreement along the lines of PNR. The agreement, as outlined by Faull, would have three parts ) undertakings, an international agreement and notification by SWIFT to its customers. Comment: The third aspect of customer notification is agreed in principle by all, and SWIFT and its banks are working towards implementation although the practical obstacles should not be under-estimated. END COMMENT. According to Faull, this package would end the legal uncertainty in the EU and data protection authorities would not be able to challenge SWIFT. ¶13. (C/NF) DOJ Attache Mark Richard asked Faull how the SWIFT case could be distinguished from other cases where the US requests data located in the US from a company for law enforcement purposes. Richard asked if we would need to negotiate with the EU in each case in which data generated by EU entities is retained in the US and is sought by US law enforcement agencies? Richard posited that such an approach would be unacceptable. Faull,s response was that we cannot deal with every problem at once ) and mentioned credit cards as an example -- and that issues eed to be dealt with one at a time. Faull alo referred to the broader US-EU discussions o data protection in the law enforcement context. Richard argued that to substitute the US and the EU for the private party in all conflict of law situations would be a sweeping and revolutionary new approach. Richard suggested that it would be better to modify the way in which SWIFT complies with the US subpoenas to take into account the EU data protection concerns, rather than to have a US-EU agreement. ¶14. (C/NF) Faull said that SWIFT is faced with the dilemma of moving to a country that has adequate data protection or a US-EU agreement. Freis responded that it would be unfortunate and irrational for SWIFT to move out of the US in response solely to European data protection concerns. ¶15. (C/NF) Faull then provided further details on how the agreement would work. The US would provide undertakings that would reflect how the US treats the data. The undertakings would be based on the exchange of letters between SWIFT and the US Treasury. Faull said that the undertakings would make clear that the data is only used for counterterrorism purpose and that there is no data mining. Faull said that the undertakings would also need to address data retention and deletion issues, IT security, redress for those wrongly caught up in the system. The second part of the package would be a US-EU agreement that would refer to the undertakings. Relying on the undertakings, the EU would say to SWIFT you may (or possibly you must) transmit data to the US in the knowledge that the data are subject to US laws and reference Treasury,s Terrorist Finance Tracking Program. SWIFT would also do more to inform their customers about how their data is being processed. ¶16. (C/NF) Freis asked for clarification as to what the US would be agreeing to do under the agreement. Freis said that what Faull described as the agreement only involves the Commission and SWIFT and not the USG. Faull admitted that the analogy of the agreement to a contract does break down, but said that an agreement between SWIFT and the EU would not be the right legal instrument. He said that the Commission does not have agreements with private parties. Freis responded that the linking of the undertakings and the agreement would be restricting the US subpoena powers. Faull claimed that was not the intent and that wording could be found to make that clear. Faull stated that the EU has no right to regulate the subpoena powers of the US. Freis said that he would need to consider whether such an agreement would create precedents in the US, that regardless of an intent to distinguish facts here, they were proposing to restrict the exercise of U.S. domestic law enforcement authorities. Freis also expressed great concern over how as a legal matter a distinction could be made between SWIFT where the Commission is requesting an agreement and other cases involving data kept by multinationals in multiple countries subject to domestic law enforcement. ¶17. (C/NF) Faull asked if it would be possible for Europeans to be added to the oversight mechanism. Freis said that the US was open to exploring the possibility of sharing BRUSSELS 00000253 004 OF 005 more information about how the TFTP works and benefits Europe, and would be open to a visit to Washington. Freis made clear that the US would have problems if the participants were European data protection authorities; this was a "non-starter." Faull noted this. ¶18. (C/NF) At the end of the meeting, Faull said that work had already started on a draft. He offered to provide a proposal for the US to consider although he was not able to say when the draft would be ready. (Note: Faull left January 18 for a vacation through the end of January.) Freis indicated a draft would be very helpful. UK: Cooperative but protecting sovereign prerogatives ¶19. (C/NF) Freis met separately with the UK Finance and JHA attaches. Michael Collins from HM Treasury said the UK,s primary objective is to maintain the flow of data and USG access to it. He said that within Whitehall there is no consensus on the best way forward. Collins said that when the Commission presented the idea of negotiations to the EU Ambassadors on December 20, there was no consensus among member states. He said that the Danes had demanded greater clarity on the way forward before exploratory talks with the US, and warned the Commission not to move without the member states. He also said that the Germans had suggested that a special working party be set up in the Council, but since then the Germans have not followed up despite UK and other member state requests for more detail. ¶20. (C/NF) In another meeting, Vijay Rangarajan, UK JHA Counselor, made a very strong pitch for resolving the issue under the EU,s first pillar. He argued that the Commission approach that this is a third pillar issue was wrong. Taking a first pillar approach would require the Commission to make an adequacy determination with respect to the transmission of SWIFT data for commercial purposes. Once the data is transferred to the US legally for commercial purposes under the adequacy determination, then the EU cannot deny the US access to the data for law enforcement purposes. He said that he did not think an agreement was necessary or desirable for either the US or the EU. He said that trying to do this under the EU,s third pillar would have consequences of &epic proportions8 for the UK because of the sensitivities of having the Commission dealing with the activities of intelligence agencies, which fall outside even the third pillar. ¶21. (C/NF) Rangarajan said that the EU has been discussing internally how to deal with data protection in the third pillar for two years. He said that they are farther away from an agreement than when the discussions started. He said that trying to resolve SWIFT under the third pillar would run straight into all of those same issues which would not lead to a quick or easy resolution of the matter. Sweden: a broad practical European approach ¶22. (C/NF) At the Swedish Permanent Representation, Freis met with Charlotta Erikson, Counsellor for Financial Affairs, and Henrik Kjellin, who is responsible for data protection issues. Erikson said that within the Swedish government, the Ministry of Finance has the lead on this issue. From the Ministry,s perspective, there are three important aspects that need to be considered: terrorism finance, data protection and the general payment systems. She said that Sweden did not have a solution to offer, but that the government supported a practical European initiative. Erikson noted that because it involves payment systems, Sweden has been advocating for DG Internal Market to be involved as well. Erikson said that while some have compared the SWIFT case to PNR, Sweden does not see the connection because in the SWIFT case the data is in the US. ¶23. (C/NF) Speaking candidly, Erikson said that the Commission handling of this has been &sloppy8 with Frattini maing remarks to the European Parliament about negotiating with the US that caught everyone by surprise. The day after speaking at the Parliament, Frattini briefed EU Ambassadors and said that he would be seeking a negotiating mandate in June. Erikson commented that the process was backwards going to Parliament first. She also noted that the European Parliament would likely &raise hell8 during meetings on SWIFT scheduled for the end of January, despite its limited competence in the issue, and will continue to keep the issue on the agenda. ¶24. (C/NF) Erikson said that it is unclear how the German Presidency wants to handle the issue. She said that the Germans are unhappy to have to deal with this issue, which was not foreseen as part of their Presidency program. At BRUSSELS 00000253 005 OF 005 some point, however, the Presidency and the Commission will need to work together. Member states are now waiting to hear what the Commission has in mind as a way of resolving this problem and then they will react to the Commission proposal. ¶25. (C/NF) Erikson said that Sweden has answered the letter that Commissioner Frattini sent to all member states in December. According to Erikson, the Swedish response was basically that the government was not aware of the issue. ¶26. (U) This cable was cleared by James Freis. GRAY .