SWIFT attempts restructuring
For the London Free Press – November 12, 2007
Partly in response to concerns from privacy advocates, the Society for Worldwide Interbank Financial Telecommunication (SWIFT) announced it will be restructuring its systems architecture.
At the heart of this restructuring will be the creation of a global data processing centre in Switzerland.
SWIFT, a Belgium-based company, provides messaging services and interface software to the global banking industry in more than 200 countries. SWIFT’s purpose is to act as an intermediary to transmit secure financial information exchanges among financial institutions.
The network’s computing centre is located in the United States. In recent years, there have been concerns SWIFT has disclosed personal information about individuals, including Canadians, to the US government. This move would place international transfer data outside of the immediate access of U.S. authorities.
While this should please privacy advocates in the European Union, it does not appear Canadians will share in this new found protection. SWIFT’s intention is to operate the data centre as an additional facility rather than as a replacement to its U.S. facility.
Under the new system SWIFT will create two message processing zones: Europe, handled by their Swiss facility, and Transatlantic which will continue to be handled at their U.S. facility. The system will be based on the concept that messages within a zone will remain in their region of origin with an aim to addressing concerns expressed by data privacy watchdogs.
SWIFT’s restructuring effort is scheduled to be completed by the end of 2009. The network has secured a safe harbor agreement regarding its U.S. data centre.
In the past, SWIFT has only released vague and generalized statements regarding its compliance with European or Canadian privacy standards.
They have also been unwilling to confirm personal information pertaining to Canadians or Canadian banks has been subject to improper distribution.
The safe harbor agreement amounts to SWIFT volunteering to abide by data protection provisions in compliance with European standards, even while the data remains in the U.S.
If SWIFT were to breach the agreed data protection provisions the Federal Trade Commission could, in theory, intervene. Since the United States can order data on its territory to be handed over, one has to wonder how effective this really is.
Aware of this, SWIFT has attempted to reassure customers of the security of their data, assuring that they have implemented “unique protective measures” as well as receiving “security guarantees” from the U.S. government for the term of the agreement.
This agreement will stay in effect until the new Swiss facility commences operations. There has been no indication whether any protection that Canadian data may be benefiting from would continue after that time.
Concerns over the use of data by SWIFT are not limited to Canada and the European Union. In the U.S. itself, two U.S. bank customers have initiated law suits claiming that their bank transfer information was illegally provided to security authorities by SWIFT.
The U.S. government is attempting to block these lawsuits.






