Transfer of international payment transaction data to foreign governments for the purpose of complying with their sanctions regime

Within the context of their international business activities, Swiss financial institutions may find themselves having to provide evidence to foreign governments (especially the USA) that they respect the sanctions imposed by those countries. Failure to do so may in certain circumstances result in a curtailment of their activities in the country in question. One Swiss credit institution, which acted as a transfer bank for international payments, considered voluntarily handing over the transfer data to the US authorities. After examining the case as well as the legal situation, we reached the conclusion that to prove that the bank had respected US laws, a voluntary disclosure of the transfer data could only be authorised if it was anonymized.

We were asked by a Swiss credit institution to determine whether under the FADP it was permissible to provide data to a foreign authority within the context of international payment transfers. In this particular case, the Swiss bank was an intermediary in the payment chain involving international payment flows, and it wanted to provide the US authorities with proof that its transfer operations complied with US sanctions on Iran.

The FADP is applicable as financial transfers involve the processing of personal data. The disclosure of data is therefore only admissible if there is no illegal infringement of the data subject’s privacy. As there is no legal basis for the disclosure of transaction data to the US authorities and there is no overriding public or private interest at stake, it was necessary to examine to what extent implicit consent could be assumed.

The Swiss bank argued that a person who places a US dollar transfer order must assume that the data processing will be carried out in the USA. Within the financial world, everybody is aware that foreign currency transactions, with very few exceptions, are carried out in the country of the currency and that domestic banks maintain nostro and vostro accounts with foreign banks. However, most private individuals are unaware of this, and therefore in our view it cannot be assumed that this is a generally known fact. Thus, a bank that carries out a foreign currency transaction (in this particular case in US dollars) must inform their client that data may be transferred to a bank in the country of the currency (i.e. the USA). However, the transfer bank that receives the order can assume that the bank of the instructing party has provided their client with the relevant information.

In cases where a Swiss credit institution carries out a transfer via a US bank or subsidiary, the fact that the US authorities may gain access to the data by invoking US law does not raise any data protection concerns since for the purposes of carrying out the transfer, the client has consented for the data to be transferred abroad. On the other hand, a voluntary post hoc disclosure of the data to the US authorities would violate data processing principles (in particular the proportionality principle). We therefore came to the conclusion that a voluntary disclosure of data to the US authorities in the present case was not admissible. However, there is no case of infringement of the FADP to answer if the US authorities request the subsidiary of a Swiss credit institution in the USA or a US correspondent bank to provide the transfer data transmitted to the USA, if it is acting within its legal rights.

Furthermore, it should be noted that, as a general rule, sanctions are not applied to individuals but to states. The Swiss bank therefore has the possibility to anonymize the transaction data in such a way that the sending or receiving state, and perhaps even the city, may be decided, but not the identity of the persons involved in the transaction. By acting in this manner, the Swiss bank would be able to provide the foreign authority with the proof that it has respected the sanctions, and at the same time has taken adequate data protection measures.

Last modification 30.06.2008

Top of page