Following the debate on 16 September 2009, the European Parliament adopted a resolution on the envisaged international agreement to make available to the United States Treasury Department financial payment messaging data to prevent and combat terrorism and terrorist financing.

The resolution had been tabled by the EPP, S-D, ALDE and ECR groups.

Members stressed the need to strike the right balance between security measures and the protection of fundamental rights, and therefore that all transfers of European personal data to third countries for security purposes should respect procedural guarantees and defence rights and comply with data-protection legislation at national and European level.

Parliament recalls that the Society for Worldwide Interbank Financial Telecommunications (SWIFT) announced in October 2007 a new messaging structure to be operational by the end of 2009, which would mean that the majority of the financial data that SWIFT had thus far been subpoenaed to transfer to the US Treasury Department's Terrorist Finance Tracking Program (TFTP) would no longer be made available to the TFTP. On 27 July 2009 the Council unanimously adopted the negotiating directives for the negotiation by the Presidency of an international agreement with the US to continue the transfer of SWIFT data to the US TFTP. Parliament points out that the negotiating directives, which were not adopted until almost two years after SWIFT announced the change in messaging structure, together with the legal opinion on the choice of legal basis issued the Council's Legal Service, have not been made public, since they are classified "EU Restricted". It is concerned that access to data managed by SWIFT makes it potentially possible to detect not only transfers linked to illegal activities but also information on the economic activities of the individuals and countries concerned, and could thus be misused for large-scale forms of economic and industrial espionage.

Members remind the Council and the Commission that the transatlantic framework of the EU-US agreement on legal assistance, which will enter into force on 1 January 2010, provides for access to be granted to targeted financial data upon request, through national state authorities. This might constitute a sounder legal basis for the transfer of SWIFT data than the proposed interim agreement, and Parliament asks the Council and the Commission to explain the need for an interim agreement. It is concerned that the legal services of the institutions have expressed divergent opinions on the legal basis, and notes that the Council's Legal Service is of the opinion that it is a Community competence.

To the extent that an international agreement is absolutely necessary, Parliament insists that it must fulfil certain minimum conditions which it lays down in the resolution. These include the following:

that data are transferred and processed only for the purposes of fighting terrorism and that they relate to individuals or terrorist organisations recognised as such also by the EU; that the transfer requests are based on specific, targeted cases, limited in time and subject to judicial authorisation, and that any subsequent processing is limited to data which disclose a link with persons or organisations under examination in the US. Data which do not disclose such links must be erased; that EU citizens and enterprises are granted the same defence rights and procedural guarantees and the same right of access to justice as exist in the EU and that the legality and proportionality of the transfer requests are open to judicial review in the US; that transferred data are subject to the same judicial redress mechanisms as would apply to data held within the EU, including compensation in the event of unlawful processing of personal data; that the agreement prohibits any use of SWIFT data by US authorities for purposes other than those linked to terrorism financing, and that the transfer of such data to third parties other than the public authorities in charge of the fight against terrorism financing is also prohibited; that a reciprocity mechanism is strictly adhered to, obliging the competent US authorities to transfer relevant financial messaging data to the competent EU authorities, upon request; that the agreement is expressly set up for an intermediate period by means of a sunset clause not exceeding 12 months, and without prejudice to the procedure to be followed under the Lisbon Treaty for the possible conclusion of a new agreement in this field; that the interim agreement clearly provides for the US authorities to be notified forthwith after the entry into force of the Lisbon Treaty and that a possible new agreement will be negotiated under the new EU legal framework that fully involves the European Parliament and national parliaments;

Parliament requests the Council and the Commission to confirm that batches and large files such as those concerning transactions relating to the Single European Payment Area (SEPA) fall outside the scope of the data to be requested by or transferred to the US Treasury Department.

Lastly, it underlines the importance of legal certainty and immunity for citizens and private organisations subject to data transfers under such arrangements as the proposed EU-US agreement.