a In order to facilitate the efficient exchange of information, Europol may designate a liaison
officer to the U.S. Treasury Department. The modalities of the liaison officer's status and tasks shall

be decided jointly by the Parties.

ARTICLE 10

EU Requests for TFTP Searches

Where a law enforcement, public security, or counter terrorism authority of a Member State, or
{Europol or Eurojust. determines that there is reason to believe that a person or entity has a nexus to
terrorism or its financing as defined in Articles | to 4 of Council Framework
Decision 2002/475/JHA, as amended by Council Framework Decision 2008/919/SHA and
Directive 2005/60/LC, such authority may request a search for relevant information obtained
through the TFTP. The U.S. Treasury Department shall promptly conduct a search in accordance
with Article 5 and provide relevant information in response to such requests.

ARTICLE 11

Cooperation with Future Equivalent EU System

1. During the course of this Agreement, the European Commission will carry out a study into the

possible introduction of an equivalent EU system allowing for a more targeted transter of data.

USA//EU/en 20


9. The Parties shall jointly coordinate with regard to the technical modalities necessary to

support the Europol verification process.

ARTICLE 5

Safeguards Applicable to the Processing of Provided Data

General Obligations

{la The U.S. Treas

ry Department shall ensure that Provided Data are processed in accordance
with the provisions of this Agreement, The U.S. Treasury Department shall ensure the protection of
personal data by means of the following safeguards, which shall be applied without discrimination,

in particular on the basis of nationality or country of residence.

2. Provided Data shall be processed exclusively for the prevention, investigation, detection, or

prosecution of terrorism or its financing,

3. The TETP does not and shall not involve data mining or any other type of algorithmic or

automated protiling or computer filtering.

USA//EU/en t4


ARTICLE 14

Transparency ~ Providing Information to the Data Subjects

The U,

. Treasury Department shall post on its public website detailed information concerning the
[FTP and its purposes, including contact information for persons with questions. In addition, it
shall post information about the procedures available for the exercise of the rights described in
Articles 15 and 16, including the availability of administrative and judicial redress as appropriate in

the United States regarding the processing of personal data received pursuant to this Agreement.

ARTICLE 15
Right of Access
1 Any person has the right to obtain, following requests made at reasonable intervals, without
coustraint and without excessive delay, at least a contirmation transmitted through his or her data
protection authority in the European Union as to whether that person's data protection rights have

been respected in compliance with this Agreement, afier afl necessary verifications have taken

place, and, in particular, whether any processing of that person's personal data has taken place in
breach of this Agreement.

USA//EU/en 24


MINDFUL of Article 6(2) of the Treaty on European Union on respect for fundamental rights, the
right to privacy with regard to the processing of personal data as stipulated in Article 16 of the

Treaty on the Functioning of the European Union, the principtes of proportionality and neces

concerning the right to private and family life, the respect for privacy, and the protection of personal
data under Article 8(2) of the European Convention on the Protection of Human Rights and
Fundamental Freedoms, Council of Europe Convention No, 108 for the Protection of Individuals
with regard to Automatic Processing of Personal Data, and Articles 7 and 8 of the Charter of

Fundamental Rights of the European Union;

MINDFUL of the breadth of privacy protections in the United States of America ("United States"),
as reflected in the United States Constitution, and in its criminal and civil legislation, regulations,
and long-standing policies, which are enforced and maintained by checks and balances applied by

the three branches of government:

STRESSING the common values governing privacy and the protection of personal data in the
European Union and the United States, including the importance which both Parties assign to due

process and the right to seek effective remedies for improper government action:

MINDFUL of the mutual interest in the expeditious conclusion of a binding agreement between the
European Union and the United States based on common principles regarding the protection of
personal data when transferred for the general purposes of law enforcement, bearing in mind the
importance of carefully considering its effect on prior agreements and the principle of effective

administrative and judicial redress on a non-discriminatory basis:

USA//EU/en 5


ANNEX

Society for Worldwide Interbank Financial Telecommunication (SWIFT).

USA/EU/Annex/en |


2) If. following this study, the European Union decides to establish an EU system, the United

States shall cooperate and provide assistance and advice to contribute to the effective establishment

of such a system.

3 Since the establishment of an EU system could substantially change the context of this
Agreement, if the European Union decides to establish such a system, the Partics should consult to
determine whether this Agreement would need to be adjusted accordingly, In that regard, U.S. and
EU authorities shall cooperate to ensure the complementariness and efficiencies of the U.S. and

EU systems in a manner that further enhances the security of citizens of the United States. the

European Union, and elsewhere. In the spirit of this cooperation, the Parties shall actively pursue,
on the basis of reciprocity and appropriate safeguards, the cooperation of any relevant international
financial payment messaging service providers which are based in their respective territories for the

purposes of ensuring the continued and effective viability of the U.S, and EU systems.

ARTICLE 12

Monitoring of Safeguards and Controls

|. Compliance with the strict counter terrorism purpose limitation and the other safeguards set
out in Articles 5 and 6 shail be subject to monitoring and oversight by independent overseers,
including by a person appointed by the European Commission, with the agreement of and subject to
appropriate security clearances by the United States. Such oversight shall include the authority to
review in real time and retrospectively all searches made of the Provided Data, the authority to
query such searches and, as appropriate, to request additional justification of the terrorism nexus. In
particular, independent overseers shall have the authority to block any or all searches that appear to

be in breach of Article 5.

USA//EU/en 21


ARTICLE 18

Redress

1. The Parties shall take all reasonable steps to ensure that the U.S. Treasury Department and
any relevant Member State promptly inform one another, and consult with one another and the
Parties. if necessary. where they consider that personal data have been processed in breach of

this Agreement.

2. Any person who considers his or her personal data to have been processed in breach of this
Agreement is entitled to seek effective administrative and judicial redress in accordance with the
laws of the European Union, its Member States, and the United States, respectively. For this

puspose and as regards data transferred to the United States pursuant to this Agreement, the

Treasury Department shall treat all persons equally in the application of its administrative
process, regardless of nationality or country of residence. Al persons, regardless of nationality or
country of residence, shall have available under U.S. law a process for seeking judicial redress from

an adverse administrative action.

ARTICLE 19
Consultation
1. The Parties shall, as appropriate, consult cach other to enable the most effective use to be

made of this Agreement. including to facilitate the resolution of any dispute regarding the

interpretation or application of this Agreement.

USA//EU/en 27


2. The review shall have particular regard to (a) the number of financial payment messages
accessed. (b) the number of occasions on which leads have been shared with Member States, third
countries. and Europol and Eurojust, (c) the implementation and effectiveness of this Agreement.
including the suitability of the mechanism for the transfer of information, (d) cases in which the
information has been used for the prevention. investigation, detection, or prosecution of terrorism or
its financing, and (e) compliance with data protection obligations specified in this Agreement. The

review shall include a representative and random sample of searches in order to verify compliance

with the safeguards and controls set out in this Agreement, as well as a proportionality assessment
of the Provided Data. based on the value of such data for the investigation. prevention, detection, or
prosecution of terrorism or its financing. Following the review, the European Commission will
present a report to the European Parliament and the Council on the functioning of this Agreement,

including the areas mentioned in this paragraph.

3 For the purposes of the review, the United States shall be represented by the U.S. Treasury
Zach Party

Department. and the European Union shall be represented by the European Commission.
may include in its delegation for the review experts in security and data protection, as well as a
person with judicial experience. The European Union review delegation shall include
representatives of two data protection authorities, at least one of which shall be from a

Member State where a Designated Provider is based.
4 For the purposes of the review. the U.S. Treasury Department shall ensure access to relevant

documentation. systems, and personnel. The Parties shall jointly determine the modalities of

the review

USA//EU/en 23




ARTICLE 7

Onward Transfer

Onward transter of information extracted from the Provided Data shall be limited pursuant to the

following safeguards:

(a) Only information extracted as a result of an individuatized search as described in this

Agreement, in particular Article 5, shall be shared;

(b) Such information shall be shared only with law enforcement, public security, or counter
terrorism authorities in the United States, Member States, or third countries, or with Europol
or Eurojust, or other appropriate international bodies, within the remit of their

respective mandates;

(c) Such information shall be shared for lead purposes only and for the exclusive purpose of the

investigation, detection, prevention, or prosecution of terrorism or its financing;

(d) Where the U.S. Treasury Department is aware that such information involves a citizen or
resident of a Member State, any sharing of the information with the authorities of a third
country shall be subject to the prior consent of competent authorities of the concerned
Member State or pursuant to existing protocols on such information sharing between the U.S.
Treasury Department and that Member State, except where the sharing of the data is essential
for the prevention of an immediate and serious threat to public security of a Party to this
Agreement, a Member State, or a third country. In the latter case the competent authorities of

the concerned Member State shall be informed of the matter at the earliest opportunity;

USA/EU/en 18


ARTICLE 2

Scope of Application

Conduct Pertaining to Terrorism or Terrorist Financing

This Agreement applies to the obtaining and use of financial payment messaging and related data

with a view to the prevention, investigation, detection, or prosecution of:

(ay

(b)

Acts of a person or entity that involve violence, or are otherwise dangerous to human life or
create a risk of damage to property or infrastructure, and which, given their nature and.

context, are reasonably believed to be committed with the aim of:

(i) intimidating or coercing a population;

(ii) intimidating, compelling, or coercing a government or international organization to act

or abstain [rom acting; or

(ili) seriously destabilizing or destroying the fundamental political, constitutional, economic,

or social structures of a country or an international organization;
A person or entity assisting, sponsoring, or providing financial, material, or technological

support for, or financial or other services to or in support of, acts described in.

subparagraph (a);

USA//EU/en 10


For the United States of America

3a Creamenste Amepukancnn Ulars
Por los Estados Unidos de América

Za Spojené stéty americké

For Amerikas Forenede Stater

Fiir die Vereiniyten Staaten von Amerika
Ameerika Lhendriikide nime!

Tra tig Hycpéves Moaircies me Apepiniy:
Pour les Etats-Unis d'Amerique

Per gli Stati Uniti d'America

Amerikas Savienoto Valstu varda
Jungtiniy Amerikos Valstijy vardu

az Amevikai Egyesilt Allamok részér6i
Ghail-tstati Uniti ta’ Amerika

Voor de Verenigde Staten van Amerika
W imieniu Standw Zjednoczonych Ameryki
Pelos Estados Unidos da América

Pentru Statele Unite Ale Americii

Za Spojene staty americké

Za Zdruzene drzave Amerike

Amerikan vhdysvaltojen puolesta

For Amerikas férenta stater

For the European Union
ja EaponeiicKiis cb103

Por kt Union Europea

Za Evropskou unit

For Den Europaiske Union

Fiir dic Europaische Union

Euroopa Liidu nimct

Pe my Experuixy Evoon

Pour !"Union européenne

Per P Unione europea

Eiropas Savienibas varda —

Europos Sajungos vardu

Az Europai Unio részérél

Ghall-Unjoni Ewropea

Voor de Europese Unie

W imicniu Unii Europejskici

Pela Unido Europeia

Pentra Uniunea Europeana

Za Curopsku tniu

Za Evropsko unijo

Furoopan unionin puolesta

Fér Europciska unionen

USA/EU/X 3


2. This Agreement will only apply to Denmark, the United Kingdom, or Ireland if the

European Commission notifies the United States in writing that Denmark, the United Kingdom, or

Ireland has chosen to be bound by this Agreement.

3 {f the European Commission notifies the United States before the entry into force of this

Agreement that it will apply to Denmark, the U:

ited Kingdom, or lveland, this Agreement shall

apply to the territory of such State on the same day as for the other EU Member States bound by

this Agreement

4. Hf the European Commission notifies the United States after the entry into force of this
Agreement that it applies to Denmark, the United Kingdom, or treland, this Agreement shall apply
to the territory of such State on the first day of the month following receipt of the notification by the
United States

ARTICLI

23
Final Provisions
t. This Agreement shall enter into force on the first day of the month after the date on which the

Parties haye exchanged notifications indicating that they have completed their internal procedures

tor this purpose.

USA//EU/en 30


MINDFUL that non-discriminatory administrative and judicial redress is available under U.S. law
for the mishandling of personal data, including under the Administrative Procedure Act of 1946, the
Inspector General Act of 1978, the Implementing Recommendations of the 9/11 Commission Act of

2007, the Computer Fraud and Abuse Act. and the Freedom of Information Act;

RECALLING that by taw within the European Union customers of financial institutions and of
providers of financial payment messaging services are informed in writing that personal data
contained in financial transaction records may be transferred to Member States’ or third countries’
public authorities for law enforcement purposes and that this notice may include information with

respect to the TFTP:

RECOGNIZING the principle of proportionality guiding this Agrcement-and implemented by both
the United States and the European Union; in the United States through reasonableness
requirements derived from the United States Constitution and federal and state laws. and their
interpretive jurisprudence, as well as through prohibitions on overbreadth of production orders and
on arbitrary action by government officials: and in the European Union as derived from the
European Convention on Human Rights and Fundamental Freedoms, its applicable jurisprudence,

and EU and Member State legislation:

USA//EU/en 7


NOTING the rigorous controls and safeguards utilized by the U.S. Treasury Department for the

handling, use, and dissemination of financial payment messaging data pursuant to the TETP, as

described in the representations of the U.S. Treasury Department published in the Official Journal
of the European Union on 20 July 2007 and the Federal Register of the United States
on 23 October 2007, which reflect the ongoing cooperation between the United States and the

European Union in the fight against global terrorism;

RECOGNIZING the two comprehensive reviews and reports of the independent person appointed
by the European Commission to verify compliance with the data protection safeguards of the TFTP,
voncluding that the United States was complying with the data privacy protection practices outlined
in its Representations and further that the TFTP has generated significant security benefits for the
European Union and has been extremely valuable not only in investigating terrorist attacks but also

in preventing a number of terrorist attacks in Europe and elsewhere;

MINDFUL of the European Parliament's resolution of 5 May 2010 on the Recommendation from
the Commission to the Council to authorize the opening of negotiations for an agreement between
the European Union and the United States to make available to the U.S. Treasury Department

financial messaging data to prevent and combat terrorisin and terrorist financing;
RECALLING that, to guarantee effective exercise of their rights, any person irrespective of

nationality is able 10 lodge a complaint before an independent data protection authority, other

similar authority, or independent and impartial court or tribunal, to seek effective remedies;

USA//EU/en 6


fe) In sharing such information, the U.S, Treasury Department shall request that the information
shall be deleted by the recipient authority as soon as it is no longer necessary for the purpose

far which it was shared: and

(8) Each onward transfer shall be duly logged.

ARTICLE 8

‘Adequacy

Subject to ongoing compliance with the commitments on privacy and protection of personal data set
out in this Agreement, the U.S. Treasury Department is deemed to ensure an adequate level of data
protection for the processing of financial payment messaging and related data transferred from the

European Union to the United States for the purposes of this Agreement.

ARTICLE 9

Spontafeous Provision of Information

1. The U.S. Treasury Department shall ensure the availability, as soon as practicable and in the
most expedient manner, to law enforcement, public security, or counter terrorism authorities of
concerned Member States, and, as appropriate, to Europol and Eurojust, within the remit of their
respective mandates, of information obtained through the TFTP that may contribute to the
investigation, prevention, detection, or prosecution by the European Union of terrorism or its
financing. Any follow-on information that may contribute to the investigation, prevention,
detection, or prosecution by the United States of terrorism or its financing shall be conveyed back to

the United States on a reciprocal basis and in a reciprocal manner,

USA//EU/en 19


ARTICLE |

Purpose of Agreement

1. The purpose of this Agreement is to ensure, with full respect for the privacy, protection of

personal data, and other conditions set out in this Agreement, that

(a) financial payment messages referring to financial transfers and related data stored in the
territory of the European Union by providers of international financial payment messaging
services, that are jointly designated pursuant to this Agreement, are provided to the U.S
Treasury Department for the exclusive purpose of the prevention, investigation, detection, or

prosecution of terrorism or terrorist financing: and

(b) — relevant information obtained through the TFTP is provided to law enforcement, public
security, or counter terrorism authorities of Member States, or Europol or Eurojust, for the
purpose of the prevention, investigation, detection, or prosecution of terrorism or

terrorist financing.
2. The United States, the European Union. and its Member States shall take all necessary and

appropriate measures within their authority to carry out the provisions and achieve the purpose of

this Agreement.

USA//EU/en 9


2. Disclosure to a person of his or her personal data processed under this Agreement may be

subject to reasonable legal limitations applicable under national law to safeguard the prevention,
detection, investigation. or prosecution of criminal offences, and to protect public or national

security, with due regard for the legitimate interest of the person concerned.

3. Pursuant to paragraph I, a person shall send a request to his or her European nationat

supervisory authority, which shall transmit the request to the Privacy Officer of the U.S. Treasury
Department, who shall make all necessary verifications pursuant to the request. The Privacy Officer
of the U.S, Treasury Department shall without undue delay inform the relevant European national
supervisory authority whether personal data may be disclosed to the data subject and whether the
data subject's rights have been duly respected. In the case that access to personal data is refused or
restricted pursuant to the limitations referred to in paragraph 2, such refusat or restriction shall be
explained in writing and provide information on the means available for seeking administrative and

judiciat redress in the United States.

ARTICLE 16

Right to Rectification, Erasure, or Blocking

1. Any person has the right to seek the rectification, erasure, or blocking of his or her personal

data processed by the U.S. Treasury Department pursuant to this Agreement where the data are

inaccurate or the processing contravenes this Agreement.

AV/EU/en 25


AGREEMENT

BETWEEN THE UNITED STATES OF AMERICA

AND THE EUROPEAN UNION
ON THE PROCESSING AND TRANSFER
OF FINANCIAL MESSAGING DATA
FROM THE EUROPEAN UNION TO THE UNITED STATES

FOR THE PURPOSES OF THE

TERRORIST FINANCE TRACKING PROGRAM

USA/EU/en 1


lL

ARTICLE 4

U.S. Requests to Obtain Data from Designated Providers

For the purposes of this Agreement, the U.S. Treasury Department shall serve production

orders ("Requests"), under authority of U.S. law, upon a Designated Provider present in the territory

of the United States in order to obtain data necessary for the purpose of the prevention,

investigation, detection, or prosecution of terrorism or terrorist financing that are stored in the

territory of the European Union.

(b}

(c)

id)

The Request (together with any supplemental documents) shall:

identify as clearly as possible the data, including the specific categories of data requested, that
are necessary for the purpose of the prevention, investigation, detection, or prosecution of

terrorism or terrorist finaneing;

clearly substantiate the necessity of the data;

be tailored as narrowly as possible in order to minimize the amount of data requested, taking
due account of past and current terrorism risk analyses focused on message types and
geography as well as perceived terrorism threats and vulnerabilities, geographic, threat, and

vulnerability analyses; and

not seek any data relating to the Single Euro Payments Area.

USA//EU/en 12


(c) A person or entity providing or collecting funds, by any means, directly or indirectly, with the
intention that they should be used or in the knowledge that they are to be used, in full or in

part, in order to carry out any of the acts described in subparagraphs (a) or (b); or

(d) A person or entity aiding, abetting, or attempting acts described in subparagraphs (a), (b),

or(c),

ARTICLE 3

Ensuring Provision of Data by Designated Providers

The Parties, jointly and individually, shall ensure. in accordance with this Agreement and in.
particular Article 4, that entities jointly designated by the Parties under this Agreement as providers
of international financial payment messaging services ("Designated Providers”) provide to the U.S.
Treasury Department requested financial payment messaging and related data which are necessary
for the purpose of the prevention. investigation, detection, or prosecution of terrorism or terrorist
financing {"Provided Data"). The Designated Providers shall be identified in the Annex to this
Agreement and may be updated. as necessary, by exchange of diplomatic notes. Any amendments.

to the Annex shall be duly published in the Official Journal of the European Union.

USA//EU/en 11




2 Subject to Artich

«paragraph 2, this Agreement shall remain in force for a period of
five (5) years from the date of its entry into force and shall automatically extend for subsequent
periods of one (1} year unless one of the Parties notifies the other in writing through diplomatic

channels, at least six (6) months in advance, of its intention not to extend this Agreement

Done at Brussels, on 28 June 2010, in two originals, in the English language. This Agreement shalt
also be drawn up in the Bulgarian, Czech, Danish, Dutch, Estonian, Finnish, French, German,
Greek, Hungarian, Italian, Latvian, Lithuanian, Maltese, Polish, Portuguese, Romanian, Slovak,
Slovenian, Spanish, and Swedish languages. Upon approval by both Parties, these language

versions shall be considered equally authentic

USA//EU/en 31


AFFIRMING that this Agreement does not constitute a precedent for any future arrangements.
between the United States and the European Union, or between cither of the Parties and any State,
regarding the processing and transfer of financial payment messaging data or any other form of

data, or regarding data protection;

RECOGNIZING that Designated Providers are bound by generally applicable EU or national data
protection rules, intended to protect individuals with regard to the processing of their personal data,
under the supervision of competent Data Protection Authorities in a manner consistent with the

specific provisions of this Agreement; and

FURTHER AFFIRMING that this Agreement is without prejudice to other law enforcement or
information sharing agreements or arrangements between the Parties or between the United States

and Member States,

HAVE AGREED AS FOLLOWS:

USA/EU/en 8


2. The oversight described in paragraph | shall be subject to regular monitoring, including of the

independence of the oversight described in paragraph 1, in the framework of the review foreseen in
Article £3. ‘The Inspector General of the U.S. Treasury Department will ensure that the independent

oversight described in paragraph | is undertaken pursuant to applicable audit standards.

ARTICLE 13

Joint Review

1. At the request of one of the Parties and at any event after a period of six (6) months from the

date of entry into force of this Agreement, the Parties shall jointly review the safeguards, controls,

and reciprocity provisions set out in this Agreement. The review shall be conducted thereafter an a

regutar basis, with additional reviews

heduled as necessary.

USA//EU/en 22


‘The Parties shall take measures to avoid the imposition of extraordinary burdens on one
another through application of this Agreement. Where extraordinary burdens nonetheless result, the
Parties shall immediately consult with a view to facilitating the application of this Agreement,

ineluding the taking of such measures as may be required to reduce pending and future burdens.

3. The Parties shall immediately consult in the event that any third party, including an authority

of another country, challenges of a

rts a legal claim with respect to any aspect of the eflect or
implementation of this Agreement.
ARTICLE 20
Implementation and Non-derogation

| This Agreement shall not create or confer any right or benefit on any person or entity, private

or public, Each Party shall ensure that the provisions of this Agreement are properly imptemented.

Nothing in this Agreement shall derogate from existing obligations of the United States and
Member States under the Agreement on Mutual Legal Assistance between the United States of
America and the European Union of 25 June 2003 and the related bilaterat mutual legal assistance

instruments between the United States and Member States.

/EU/en 28


RECALLING the United Nations conventions for combating terrorism and ils financing, and
relevant resolutions of the United Nations Security Council in the field of tighting terrorism, in
particular United Nations Security Council Resolution 1373 (2001) and its directives that all States
shall take the necessary steps to prevent the commission of terrorist acts, including by proviston of
carly warning to other States by exchange of information; that States shall ufford one another the
greatest measure of assistance in connection with criminal investigations or criminal proceedings.
relating to the financing or support of terrorist acts; that States should tind ways of intensifying and
accelerating the exchange of operational information; that States should exchange information in
accordance with internatianal and domestic law; and that States should cooperate, particularly
through bilateral and multilateral arrangements and agreements, to prevent and suppress terrorist

attacks and to take action against perpetrators of such attacks;

RECOGNIZING that the United States Department of the Treasury's ("U.S. Treasury Department")
Terrorist Finance Tracking Program ("TFTP") has been instrumental in identifying and capturing
terrorists and their financiers and has generated many leads that have been disseminated for counter
terrorism purposes to competent authorities around the world, with particular value for

European Union Member States ("Member States");

NOTING the importance of the TFTP in preventing and combating terrorism and its financing in
the European Union and elsewhere, and the important role of the European Union in ensuring that

designated providers of international financial payment messaging servi

provide financial
payment messaging data stored in the territory of the European Union which are necessary for
preventing and combating terrorism and its financing, subject to strict compliance with safeguards

on privacy and the protection of personal data;

USA//EU/en 4


Data Security and Integrity

4, To prevent unauthorized access to or disclosure or loss of the data or any unauthorized form

of proc

sing:

(a) Provided Data shall be held in a secure physical environment, stored separately from any other

data, and maintained with high-level systems and physical intrusion controls:

(b} Provided Data shall not be interconnected with any other database

(c) Access to Provided Data shall be limited to analysts investigating terrorism or its financing

and to persons involved in the technical support, management, and oversight of the TFTP:
(d) Provided Data shall not be subject to any manipulation, alteration, or addition: and
(e) No copies of Provided Data shall be made, other than for disaster recovery back-up purposes.
Necessary and Proportionate Processing of Data
5. All searches of Provided Data shall be based upon pre-existing information or evidence which

demonstrates a reason to believe that the subject of the search has a nexus to terrorism or

its financing.

USA//EU/en 15


3. Subject to any earlicr deletion of data resulting from paragraphs 1, 2, or S, all non-extracted

data re

ved prior to 20 July 2007 shail be deleted not Jater than 20 July 2012.

4 Subject to any earlier deletion of data resulting from paragraphs 1, 2, or 5, all non-extracted

data received on or after 20 July 2007 shall be delcted not later than five (5) years from receipt.

5. During the term of this Agreement, the U.S. Treasury Department shall undertake an ongoing
and at least annual evaluation to assess the data retention periods specified in paragraphs 3 and 4 to
ensure that they continue to be no longer than necessary to combat terrorism or its financing. Where
any such retention periods are determined to be longer than necessary to combat terrorism or its,

financing. the U.S. Treasury Department shall reduce such retention periods, as appropriate.

6. Not later than three years from the date of entry into force of this Agreement, the

European Commission and the U.S. Treasury Department shail prepare a joint report regarding the
value of TFTP Provided Data, with particular emphasis on the value of data retained for multipic
years and relevant information obtained from the joint review conducted pursuant to Article 13. The
Parties shall jointly determine the modalities of this report.

7. Information extracted from Provided Data, including information shared under Article 7, shall
be retained for no longer than necessary for specific investigations or prosecutions for which they

are used.

USA//EU/en 17


THE UNITED STATES OF AMERICA.

of the one part. and
THE EUROPEAN UNION,

of the other part,
Together hereinafter referred to as "the Parties".

DESIRING to prevent and combat terrorism and its financing, in particular by mutual sharing of

information. as a means of protecting their respective democratic societies and commen values,

rights, and freedoms:

SEEKING to enhance and encourage cooperation between the Parties in the spirit of

transatlantic partnership;

USA//EU/en 3


2. Any person exercising the right expre:

d in paragraph 1 shall send a request to his or her
relevant European national supervisory authority, which shall transmit the request to the

Privacy Officer of the U.S. Treasury Department. Any request to obtain rectification, erasure, or
blocking shall be duly substantiated. The Privacy Officer of the U.S. Treasury Department shall

make all necessary verifications pursuant to the request and shall without undue delay inform the

yelevant European national supervisory authority whether personal data have been reetiffed, erased,
or blocked, and whether the data subject's rights have been duly respected. Such notification shall
be explained in writing and provide information on the means available for seeking administrative
and judicial redress in the United States.

ARTICLE 17

Maintaining the Accuracy of Information

i Where a Party becomes aware that data received or transmitted pursuant to this Agreement

ire not accurate, it shall take all appropriate measures to prevent and discontinue erroneous reliance

on such data, which may include supplementation, deletion, or correction of such data.

‘ach Party shall, where feasible, notify the other if it becomes aware that material information

it has transmitted to or received trom the other Party under this Agreement is inaccurate

or unreliable.

USA//EU/en 26


rare

Bie fea

ssi ier gat





ARTICLE 21

Suspension or Termination

1 Either Party may suspend the application of this Agreement with immediate effect, in the

event of bre:

ch of the other Party’s obligations under this Agreement, by notification through

diplomatic channels

a Either Party may terminate this Agreement at any time by notification through diplomatic

channels. Termination shall take effect six (6) months from the date of receipt of such notification.

3. The Parties shall consult prior to any possible suspension or termination in a manner which

allows a sufficient time for reaching a mutually agreeable resolution.
4. Notwithstanding any suspension ar termination of this Agreement, all data obtained by the
US. Treasury Department under the terms of this Agreement shall continue to be processed in
accordance with the safeguards of this Agreement, including the provisions on deletion of data.
ARTICLE 22
Territorial Application
1 Subject to paragraphs 2 to 4, this Agreement shall apply to the territory in which the Treaty on

European Union and the Treaty on the Functioning of the European Union are applicable and to the

territory of the United States,

USA//EU/en 29


3. Upon service of the Request on the Designated Provider. the U.S. Treasury Department shall

simultaneously provide a copy of the Request, with any supplemental documents, te Europol

4. Upon receipt of the copy, Europol shall verify as a matter of urgency whether the Request
complies with the requirements of paragraph 2. Europol shall notify the Designated Provider that it

has verified that the Request complies with the requirements of paragraph 2.

5 For the purposes of this Agreement, once Europol has confirmed that the Request complies
with the requirements of paragraph 2, the Request shal! have binding legal effect as provided under
USS. law. within the European Union as well as the United States. The Designated Provider is

thereby authorized and required to provide the data to the U.S. Treasury Department.

6. The Designated Provider shall thereupon provide the data (i.c., on a “push basis") directly to
the U.S, Treasury Department. The Designated Provider shall keep a detailed log of all data

transmitted to the U.S. Treasury Department for the purposes of this Agreement.

7. Onee the data have been provided pursuant to these procedures, the Designated Provider shall
be deemed to have complied with this Agreement and with all other applicable legal requirements.
in the European Union related to the transfer of such data from the European Union to the

United States.

8. Designated Providers shall have all administrative and judicial redress available under U.S.

law to recipients of U.S. Treasury Department Requests.

USA//EU/en 13


6, Bach individual TF TP search of Provided Data shall be narrowly tailored, shal! demonstrate a
reason to believe that the subject of the search has a nexus to terrorism or its financing, and shall be
logged, including such nexus to terrorism or its financing required to initiate the search,

7, Provided Data may include identifying information about the originator and/or recipient ofa

transaction, including name, ac

ount number, address, and national identification number. The

Parties recognize the special sensitivity of personal data revealing racial or ethnic origin, political
opinions, or religious or other beliefs, trade union membership, or health and sexual lite ("sensitive
data"), In the exceptional circumstance that extracted data were to include sensitive data, the

U.S. Treasury Department shall protect such data in accordance with the safeguards and security
measures Set forth in this Agreement and with full respect and taking due account of their

special sensitivity.

ARTICLE 6

Keiention und Deletion of Data

1. During the term of this Agreement, the U.S. Treasury Department shall undertake an ongoing
and at feast annual evaluation to identify non-extracted data that are no longer necessary to combat
terrorism or its financing. Where such data are identified, the U.S. Treasury Department shall
permanently delete them as soon as technologically feasible.

2. If it transpires that financial payment messaging data were transmitted which were not
requested, the U.S. Treasury Department shall promptly and permanently delete such data and shall

intorm the relevant Designated Provider.

USA//EU/en 16