The tragic story of SWIFT: Hope dies last

What basically everyone interested in these matters had already expected became true: despite the civil liberty concerns that it raises, the European Parliament approved the so-called SWIFT-agreement that would give the United States access to innocent European citizens' banking data in order to track money used for terrorist financing. 
 

To give a brief recap (though I assume that everyone is at least somewhat familiar with the debate): Despite a moving speech by Vice-President Joe Biden to sweet-talk the European Parliament (EP), the EP had voted down the first draft agreement in February 2010 for insufficient data protection standards, thus forcing the European Commission (EC) to go back to the negotiating table with the US. A second draft-agreement was subsequently presented to the EP and the European Public which, as explained in my earlier post, did still not meet one of the most crucial requests that the EP had set as a condition for approving the agreement. Therefore, additional concessions had to be made, until the EP eventually felt comfortable with giving its consent to the SWIFT agreement on July 8^th.

As has been reported to the public, one could not say that the MEPs did not have their reasons for approving the agreement, especially if one considers their legitimate interest in strengthening their negotiation position with regard to the Council and the Commission for future negotiations on foreign affairs issues by positioning itself as a reasonable and mature partner capable of balancing opposing interests in the delicate realm of international relations.

Yet, at a closer look it appears that most of their reasons are good enough for the uninformed public but not for someone who really bothers with the details of it. Hence, before the vote, I wrote three Members of the European Parliament (MEPs) to express my doubts regarding the agreement. The two immediate replies I received, namely from Manfred Weber (Christian-democrat/EPP) and Alexander Alvaro (Liberal/ALDE), both maintained that yet another rejection of the agreement could not be mandated. Unfortunately, they failed to give me an appropriate answer of why this was the case or to seriously dwell on my concerns.

Indeed, ignoring my arguments, the answer I got from them was simply that contrary to the draft rejected in February, European citizens' privacy and data protection rights were now more clearly regulated and that relevant civil liberty concerns had hence been sufficiently addressed to allow for the approval of the SWIFT agreement (whose very need for existence no one seems to question!): Whereas Mr. Weber just made a general statement, Mr. Alvaro was more specific and underlay its position by referring to article 16 (Right to Rectification, Erasure, or Blocking) and 18 (Redress) of the agreement to make his point. I would have hoped for more founded arguments, considering that, anticipating their answers, I had already indicated to them that I would not accept the enumerating of these articles as evidence that appropriate data protection was now accorded to Europeans in the US because, as I read the agreement, these articles have a merely symbolic meaning. (I hoped they would prove me wrong, but so far they haven't).

For those of you who are not very familiar with the agreement and the underlying context: It is true that article 16 and 18, as cited by Mr. Alvaro, generously name data protection rights. The one of special interest here is the one of article 18 as it is the one that should provide for the mechanism that is absolutely necessary for you to be able to enforce the rights accorded to you by article 16 against the US. Article 18 solemnly proclaims: 

"Any person who considers his or her personal data to have been processed in breach of this Agreement is entitled to seek effective administrative and judicial redress in accordance with the laws of the European Union, its Member States, and the United States, respectively."

What is wrong with this is precisely the fact that effective judicial redress (for the rights embedded in article 16) in accordance with the laws of the United States is an empty promise if you hold the wrong citizenship or have the wrong residence. I can only repeat over and over again that without a green card or US citizenship, you only have "the right to request access to federal agency records or information" according to the US' Freedom of Information Act (FOIA). It is true that this right is enforceable by EU citizens in US Courts, and in that sense judicial redress is available. But as a European, in a US court judicial redress is not available to enforce the more meaningful

"right to request the amendment of records that are not accurate, relevant, timely or complete; and [..] the right of individuals to be protected against unwarranted invasion of their privacy resulting from the collection, maintenance, use, and disclosure of personal information[,]"

or to sue the government for violations of these rights because these rights are provided only to people that qualify as "individuals" under the US Privacy Act of 1974, in which "individuals" are defined as those people that either hold US citizenship or a green card. Hence, the rights generously mentioned under article 16 and 18 are empty promises because, even if the US might commit to granting Europeans these rights, no corresponding right to enforce them in a US court is provided under domestic US legislation, and neither article 16 nor 18 change this. Indeed, as article 20 of the agreement states,

"[t]his Agreement shall not create or confer any right or benefit on any person or entity, private or public."

Anyone who knows a little bit about international treaty law knows that this article can't be interpreted but to mean that the EU and the US explicitly exclude the possibility that the SWIFT agreement might be self-executing. That is, the SWIFT agreement does not create rights that are directly actionable by individuals, but only a promise given to the EU by the US that European citizens' data protection rights will be respected. Therefore, whereas the EU can now request the US to respect European citizens' data protection rights lest to revoke the SWIFT agreement, as an individual there is nothing I can do if the US denies me effective judicial redress to enforce my privacy rights enshrined in the agreement, since the US does not owe any obligation directly to me or any other EU citizen. (For some general free background reading on the direct applicability of treaties in domestic US law, see here for instance.)

Moreover, the way the agreement is phrased means that the US' current legal framework is already enough to ensure the automatic compliance of the US with the obligations it owes to the EU. Indeed, the above-cited article 18 continues:

"For this purpose and as regards data transferred to the United States pursuant to this Agreement, the U.S. Treasury Department shall treat all persons equally in the application of its administrative process, regardless of nationality or country of residence. All persons, regardless of nationality or country of residence, shall have available under U.S. law aprocess for seeking judicial redress from an adverse administrative action." [emphasis mine]

The difference in the wording of "its administrative process" and "a process for seeking judicial redress" is crucial. As I see it, it can only be interpreted in the sense that no discrimination is permissible in granting administrative redress to data subjects, but that discrimination in the application of judicial redress is acceptable, as long as Europeans are granted some other type of judicial redress mechanism even if it is not the one granted to US citizens. In that sense, the US legal framework as defined by the FOIA and the Privacy Act does live up to the promise contained in article 18 of the SWIFT agreement, in that domestic US law provides for some judicial redress mechanism for the data protection rights of EU citizens. No article anywhere defines what characteristics such a mechanism should foresee or what rights should be enforceable with it to meet the article 18 requirement: To say it once again, the FOIA might foresee a judicial redress mechanism accessible by EU citizens, but only for the rights granted by that legislation which are absolutely insufficient for enforcing effective privacy and data protection safeguards. The more far-fetching privacy rights that US citizens are granted under the Privacy Act, most importantly the right to sue the US government for an unwarranted invasion of one's privacy, are still not accessible by Europeans.

Admittedly, one might spot a positive sign indicating that the US might consider changing its domestic privacy legislation in what results from a comparison between an earlier June draft of the SWIFT-agreement and the one that was eventually submitted to the EP for approval: whereas the earlier draft specifically stated that "[t]his Agreement is not intended to and shall not derogate from or amend the laws of the United States…", this has now been removed from the agreement which now says that "[e]ach Party shall ensure that the provisions of this Agreement are properly implemented. Maybe this gives some hope that the US might finally be willing to move towards recognizing the human right to privacy also of non-American human beings by extending the scope of its Privacy Act, or that the EU might at least informally require the US to adjust its legal framework. This might also be seen in the fact that the EP, when giving its consent to the conclusion of the agreement, explicitly instructed

""its President to enter into inter-parliamentary dialogue with the Speaker of the United States House of Representatives and the President pro tempore of the United States Senate on the future framework agreement on data protection between the European Union and the United States of America." 

Yet, as MEP Jan Albrecht pointed out, by approving the SWIFT agreement without a general data protection framework agreement having been concluded between Europe and the US, or without requiring changes to US domestic legislation as a necessary prerequisite for the SWIFT agreement's entry into force, the European Parliament has lost much of its leverage it could have had on the US Congress and government to amend the Privacy Act. The hope that the US might nevertheless remove the current discrimination thus seems illusionary, also because it would probably result in the illegality of many of the procedures with which the US is generally treating foreigners (US-VISIT just to mention one example). 

At this point, faced with a European Parliament that did not live up to its expectations of being a guarantor of EU citizens' interests and fundamental rights, all that there remains is to hope that my predictions are wrong and that despite the huge legal costs that this would involve, some European will make the effort to bring a lawsuit all the way up to the European Court of Justice to have the SWIFT agreement declared null and void for breaches of Europeans' fundamental freedoms and EU privacy laws. Hope dies last, so let's lean back and wait. And I will keep you posted on it.

[Comment: I met MEP Weber at a recent privacy event on September 15^th, 2010. I don't think he connected my name to the email, but I approached him to ask if he knew why the US did not want to change the US Privacy Act to encompass every person in its scope independent from nationality or residence. His reply was that the US cannot afford higher protection standards to EU citizens than it does to US citizens, which would happen if the US agreed to grant Europeans European protection standards. (European data protection standards are commonly seen as more demanding than the corresponding US standards.) While from a US perspective this is a justified position, it does not explain however why the US refuses to apply the standards it already grants to US citizens also to Europeans, and why the EP did not insist on this issue. And this was all I was asking for. Even though demanding the US to adopt EU data protection standards for the handling of EU data should be mandatory, I would settle for less: What an easy request to fulfill for the US to just extend the Privacy Act's scope to every human being! Is that a too high price to pay for widespread access to European data?]

Misunderstanding Arizona: II) the unfree foreigner

As mentioned in my earlier post, Arizona has enacted a new law, the SB1070, which requires foreigners but not US citizens to always carry an ID card on them as failure to do so constitutes a crime, and which allows any law enforcement officer during a legitimate stop of a person to check that person's immigration status if there is a "reasonable suspicion" that he or she is in the country illegally. The law has created an intense debate and several lawsuits. One of the main issues heatedly debated by the American public opinion has been the question of what constitutes a "reasonable suspicion", and how this cannot not result in racial profiling and in hassles especially for foreign-looking Americans. In that sense the SB1070 has been accused of being a racist law. The law - opponents claim - will deny (irregular) immigrants the "equal protection of the law" as mandated by the US constitution and make communities unsafer rather than safer. Regardless of the merits that this criticism might have, unfortunately no one seems to elaborate it enough or to bring the charge of racism or hostility towards foreigners (which seems to be a more appropriate term) against the very idea that underlies the law, namely that only a certain part of the population has to carry an ID card on them at all times lest to commit a crime. No one of the public opinion seems to question the basic fact that only foreigners be imposed such a burden. (Actually I came across one interesting and read worthy exception even though the author's reasons might be more connected to the effectiveness and racial profiling arguments, which I explored in my earlier post.) Could the reason for this be that SB1070 in many parts just repeats federal law? Indeed, many parts that SB1070 is criticized for are not that different at the federal level. So maybe rather than criticizing SB1070 it would be better to first examine what the federal law says before accusing Arizona of racism.

In the US, US citizens are not required to have or carry an ID card, and a national ID card system does not even exist. In the meantime, for foreigners, the Immigration and Nationality Act Section 264 (INA §264), as consolidated by 8 USC 1304 (e) and which goes back to the Alien Registration Act of 1940, (for an explanation, see here), foresees that:

"Every alien, eighteen years of age and over, shall at all times carry with him and have in his personal possession any certificate of alien registration or alien registration receipt card issued to him pursuant to subsection (d) of this section. Any alien who fails to comply with the provisions of this subsection shall be guilty of a misdemeanor and shall upon conviction for each offense be fined not to exceed $100 or be imprisoned not more than thirty days, or both."

Hence, be it according to federal law, be it according to the Arizonan law, the situation that is of our interest here is the same: Whereas US citizens under both legislations do not have the duty to have, let alone carry along an ID card, aliens do not only need to have an ID card, but they have to have it in their own personal possession at all times. More importantly, failure to do so does not just constitute a civil infraction sanctioned by some administrative fine, such as crossing a red light or speeding, but constitutes a misdemeanor, i.e. a crime. As such, I assume, it will result in an entry in the alien's criminal record. This seems like a huge imbalance of rights in favor of US citizens and like an obviously unequal treatment. I assume few people would disagree. Yet, can this sort of discrimination really be called racism?

People all over the world seem to accept the notion that foreigners be granted less rights than citizens in certain aspects. In that sense, few people would think that restricting voting rights to citizens constitutes racism. Yet, the reason for this is because the rights in question are political rights which by their very definition are reserved to people belonging to a certain group. But the problem with the Arizonan law and the US federal law that the former replicates is that none of them is about political rights. They are about rights that in American belief should safeguard an individual's life from undue interference from the government, and ensure that one be free to live his or her life. They are about privacy rights. This is also something that the German Minister of Interior Thomas de Maiziere explained to the European public when defending the US commitment to privacy protections. He was cited as explaining that:

"While Germans are perfectly comfortable with showing their ID cards with all personal data to a police officer, [...] the very idea of such a document is outrageous to Americans and Britons." (emphasis added)

And the engrained link between privacy rights and the opposition to ID cards was also confirmed by the US ambassador to the EU William Kennard when he explained in an interview,

"America is seen by some as not caring about privacy as much as those in Europe. But this portrayal is a caricature [..] When I arrived in Belgium a few months ago I was told that I had to have an identity card and that I would have to carry it with me everywhere. This is something that would be unthinkable in the US." (see page 7; emphasis added)

Yet, it is not unthinkable – not if you are non-American. And this is where the charge of racism comes in: Privacy rights and fundamental freedoms are conceived of as human rights and have their roots in the Enlightenment tradition that continues to shape both Europe and the US. As such, there is no legitimate distinction that can be made between citizens and non-citizens: If Americans don't want to be obliged to carry along an ID card as this might expose them to governmental tyranny and infringe on their fundamental freedom, then why do their representatives impose this on others? This is also in contradiction to the "Golden Rule", widely accepted by all major civilization as a compass to what can be considered moral, and which in its negative formulation states: "Do not do to others as you would not have them do to you." In that sense, it is precisely because of the very meaning Americans themselves attach to ID cards, whose rejection is perceived as a guarantee of their fundamental freedoms, that the Arizonan and the US legislation can be accused of racism: Why should foreigners not be allowed to lead a life free from undue governmental interference? Why is their private and undisturbed life not worthy of protection? Civil and privacy rights might be conceived of differently in different places, but they can't differ on the basis of what type of human being you are. Yet, this is what the current legal framework in the US – be it SB1070 or the INA §264 – does, and why it appears to be racist: it constitutes an illegitimate discrimination insofar as it restricts certain human rights to a certain category of human beings only. That such a discrimination has no foundation was also recently recognized by U.S. District Judge Susan Bolton when she blocked parts of the SB1070 before they could enter into effect, when she judged that the law "burdens lawfully-present aliens because their liberty will be restricted while their status is checked."

So let's be clear, defenders of Arizona are right when they say that for the most part, SB1070 just repeats federal law and that the harsh way in which Arizona is currently criticized is unjust. I agree, and I want to defend Arizona: its legislation might be considered racist, but we shouldn't apply double-standards. Everyone who accuses Arizona's legislation of racism, should also pick a bone with the related US legislation. It is a burden to have to carry an ID card on you at all times under the threat of criminal punishment, and it is not clear why this burden should be imposed only on a certain part of the population (especially since only an indiscriminate application of that law to everyone would make the law an effective tool for national security and in the fight against illegal immigration as seen in my earlier post).

Maybe some of you can find some reasons or don't think it is a burden to carry an ID card around, but in any case some people have the choice, while others don't. It is a pity that in the proud land of the free, some people are simply freer than others.

Schizophrenic Europe

The EU Commissioner for Home Affairs, Cecilia Malmström held a speech at the LIBE Committee meeting of the European Parliament on June 10, testifying on the ongoing EU-US renegotiation of the so-called SWIFT agreement that would grant US authorities access to the bank data of EU citizens. This in addition to some media reports has so far been the only concrete information on the results of the secret negotiations that has been given to the public.

Despite some progress made with regard to the previous agreement such as denying US authorities direct access rights to European databases or the possibility to withdraw from the agreement at any time, some questions remain unresolved: it seems unsatisfactory that once - and if - the EU decides to set up its own Terrorist Financing Tracking Programme (TFTP), the EU will only transfer less data to US authorities, but the US will not be forced to reciprocate, i.e. concede EU authorities access rights to the bank data of US citizens. If the US' TFTP is really just designed for terrorist purposes, and not to be abused for immigration control, criminal or commercial espionage purposes (on the latter, see the fears to the contrary of the Federation of German Industries (BDI)), then why should the US not trust in us, Europeans, the same way we do in the US and give us access to their bank data? Reciprocity was a key condition the European Parliament wanted to see integrated in the new agreement and it seems to be an easy to fulfill condition. Yet, the European Parliament will most likely remain disappointed.

As troubling as this might be, much more troubling is however that Malmström in her speech did not even spend a single word on the right of EU citizens to judicial redress, and that only the media provided the public with some information in regard. Judged by the media reports, it appears that the EU might be satisfied with the US' willingness to apply the Freedom of Information Act (FOIA) to the European data that is to be processed under the SWIFT agreement. This sounds good at first, especially if like me you are not an expert on US law let alone the FOIA. Luckily the US State Department provides normal citizens and non-citizens with an "information access guide" that explains them their rights. It states:

"The Freedom of Information Act (FOIA) generally provides that any person has the right to request access to federal agency records or information […]"

The same guide also explains the rights that arise under the Privacy Act:

"The Privacy Act guarantees three primary rights:

1. The right to see records about oneself, subject to Privacy Act exemptions;

2. The right to request the amendment of records that are not accurate, relevant, timely or complete; and

3. The right of individuals to be protected against unwarranted invasion of their privacy resulting from the collection, maintenance, use, and disclosure of personal information."

Wait a minute. The guide goes on:

"The procedures for filing a Privacy Act request for personal records maintained by the Department of State are the same as those described under Requesting Personal Records under the FOIA in this guide with the following exceptions:

1. You must be a citizen of the United States or an alien lawfully admitted for permanent residence to make a request under the Privacy Act.

4. No fees shall be charged for access to or amendment of records requested under the Privacy Act."

 

So, as I said, I am not an expert on US law and things might appear different once the exact terms of the SWIFT agreement will be disclosed, but judged on media reports and Malmström's silence on judicial redress it seems that even under the new agreement the EU might be content if EU citizens are granted the right to judicially enforce their "right [whose exercise requires the payment of a fee] to request access to federal agency records or information," but not the right to seek judicial redress if their records are inaccurate or their rights to privacy are being abused. This discrepancy between claims made on the basis of the US Privacy Act and the FOIA might sound like a shocking revelation. It would be shocking, if only the US had not already officially admitted this to the EU institutions long time ago back in 2008 (see page 5 and 6). So what is it that is wrong with EU policy-makers?

Maybe Europeans are simply plain stupid. Or maybe they have too much good faith. Being incapable negotiators might be another explanation, as might be the lack of any form of self-respect. Or should we resort to conspiracy theories where EU Member States have the hidden agenda of eroding privacy protections through international agreements as a precedent to be followed up soon in domestic legislation? How else can the persistence in the to-be-approved SWIFT agreement of such a fundamental flaw as is the lack of adequate judicial redress be explained? What have all the negotiations been good for?

Goodwill and intelligence assumed, the solution might be that Europeans are simply schizophrenic: It cudgels one's brain trying to understand how we Europeans can be willing to grant a foreign government a right – widespread interference in Europeans' privacy in disrespect of EU data protection standards and judicial redress mechanisms - we don't even grant our own governments which we can hold accountable through elections and lawsuits, and whose mandate is to work in our interest. Authorizing the SWIFT agreement would in that sense be a true sign of schizophrenia.

Let's just hope that the European Parliament did not vote down the first agreement for power struggle reasons, but for genuine privacy concerns, in which case we all might hope it might not approve the new deal brokered by the Commission that continues to be detrimental to EU citizens' interests. Should they approve it nevertheless, then all that remains is the sad comfort we all may find in the saying "in a democracy, people get the government they deserve." Maybe Europeans just don't deserve better.