Swift and data

Privacy is a fundamental commitment at Swift, an essential component of our core services and integral to the Swift environment. We protect the data and privacy of our customers around the world. We operate our services to strict privacy and data protection standards and in compliance with EU data protection regulation, considered as the most stringent privacy legislation in the world.

We take our commitment to privacy extremely seriously and seek to deliver a very strong degree of privacy by ensuring that all data is protected by design in the Swift environment, as well as by ensuring our full compliance with all applicable privacy and data protection laws.

Privacy protections are embedded into the design and architecture of our systems and business practices at Swift. We operate according to two important principles: privacy by design, and data minimisation.

Swift’s approach to protecting data is proactive and preventative: we aim to anticipate and prevent events before they happen; we do not wait for privacy risks to materialise; and we trust, but verify.

Privacy protections at Swift are extended securely throughout the entire lifecycle of the data involved, from start to finish. This ensures that data is securely retained, and then securely destroyed at the end of the process, in a timely fashion. Thus, we ensure cradle-to-grave, secure lifecycle management of data.

Over the years Swift has repeatedly improved transparency by enhancing its contractual documentation with respect to the processing of customers’ data (including personal data). In doing so, Swift has been assisted by a working group of data protection and compliance experts from Swift users around the world.

Data Protection Officer

Swift has appointed a Data Protection Officer who ensures that Swift complies with all applicable data protection legislation and that Swift’s own privacy and data protection policies are up to date and fit for purpose.

Messaging Services

Swift messages and data flows are encrypted, and both logical and physical security measures are implemented and monitored for continued effectiveness. Encryption and customer-to-customer authentication prevent unauthorised access by, or malicious injection of data from, internal or external sources. We constantly monitor the Swift messaging services for suspicious activity.

Some of our messaging services require Swift to store message data for 124 days. This is to ensure that customers have the ability to retrieve their own data in the case of disasters, catastrophe, queries or disputes.

Message data is stored at our operating centres (OPCs). Our OPCs are highly secure, and access to them is strictly controlled. Our security measures are designed to prevent unauthorised physical and logical access, and include physical measures that protect premises as well as logical measures that prevent unauthorised access to data.

Swift maintains three OPCs in two different continental zones (EU and Trans-Atlantic) to ensure full site redundancy.

Customers located in countries inside the European Economic Area (EEA), the United Kingdom, Switzerland and other territories and dependencies considered to be part of the European Union (EU) or associated with EU countries, are assigned to the European Zone (OPCs based in the Netherlands and Switzerland) and their intra-zone message data must remain in the EU Zone.

Customers located in the United States (US) and its territories are assigned to the Trans-Atlantic Zone (OPCs based in US and Switzerland) and their intra-zone message data must remain in the Trans-Atlantic Zone. Customers in all other countries are allocated either to the Trans-Atlantic or to the EU zone according with their preference, and in line with operational and technical criteria, such as load balancing. Messages exchanged between Swift customers in different zones are stored both in the Netherlands OPC and in the Virginia OPC, as well as in the Switzerland back-up OPC.

Data is held in two OPCs so that there is always a back-up in the case of disruption to an OPC.

Law enforcement requests

We do not share customers’ data (personal or not) with any third party unless we are authorised by our customers to do so or compelled to do so by law. We carefully review each demand we receive and, in the rare cases where we are legally compelled to provide customers’ data (which may include personal data), we respect any relevant agreements, protect our customers’ personal data to the largest extent possible, and inform our customers of our compliance with such enforceable requests unless this is prohibited by law. Transparency is important for Swift.

For example, as a consequence of the TFTP ("Terrorist Finance Tracking Program"), Swift is subject to legally binding requests to provide the U.S. Treasury Department (UST) with data located in its US OPC, which is necessary for the purpose of the prevention, investigation, detection or prosecution of terrorism or terrorist financing. The TFTP programme is controlled and audited, constantly overseen, and periodically reviewed.
 

It is limited in scope, searches are targeted, and the data is protected. Controls and safeguards are in place to ensure that the subpoenaed data, which is limited in nature, is used strictly and only for counterterrorism purposes. The controls and safeguards ensure that data may only be retained for as long as necessary for counterterrorism purposes and that all data is maintained in a secure environment and properly handled.

Similarly and for the same purposes, Swift is subject to legally binding requests under the international EU-US TFTP Agreement to provide data located in its EU OPC to the US Treasury. Swift provides such data to the US Treasury after verification of each request by Europol. The EU-US TFTP Agreement upholds EU data protection principles and provides additional safeguards, ensuring that the EU data is adequately protected and used in accordance with the principles described above.

Data Policies

Swift’s commitments in terms of data protection compliance are set out in the following documents:

• Swift General Terms and Conditions:

Swift’s General Terms and Conditions provide the general framework of Swift’s contractual documentation and underpin other applicable documents, including Swift’s data policies.

• Swift Personal Data Protection Policy:

Personal data, whether collected by Swift, provided by its users, or contained within Swift messages, is protected by the Swift Personal Data Protection Policy. This policy sets out the roles and responsibilities of Swift and its customers with regard to the processing of personal data in the context of Swift’s transaction processing services (including Swift messaging services), where Swift and Swift customers act as Joint Controllers.

As explained in the Personal Data Protection Policy, the respective roles of the customers and Swift are as follows:

• Swift customers must, each with regard to the individuals that are their clients, comply with the obligations that require a direct contact with these individuals (such as obligations concerning data quality, information, personal data breach notification, access, correction, and opposition rights).
• Swift has no relationship with the customers’ clients and does not have any capabilities to search for specific individuals mentioned in the customers’ message data. Consequently, Swift is not able to assist its customers to directly respond to requests from their clients for exercising their data subject's rights and can only comply with those obligations that cannot be performed individually by Swift customers (such as the obligations to notify personal data breaches to the Belgian Data Protection Authority and to Swift customers - if and as required under applicable law - and to ensure an appropriate legal ground for the data transfers between its operating centres).

The Swift Personal Data Protection Policy forms an integral part of the contractual arrangements between Swift and its customers for the provision and use of the Swift services and products.

Swift Data Retrieval Policy:
The Swift Data Retrieval Policy covers Swift’s policy for the retrieval, use and disclosure of traffic and message data. Swift traffic data refers to the information contained in the header or the trailer of the message or file included in the transaction data. Message data refers to the internal content of the message or the file.

Privacy statement:
Swift’s Privacy Statement on Swift.com refers to the protection of personal data processed by Swift as data controller, including for purposes of Swift governance, or data collected on our websites for purposes of recruitment, attendance at events or training courses, provision of newsletters, and participation in surveys and through cookies and online questionnaires.

Supervision by Data Protection Authorities

In May 2014 the Belgian Data Protection Authority (Commission de la protection de la vie privée/Commissie voor de bescherming van de persoonlijke levenssfeer) and the Dutch Data Protection Authority (College bescherming persoonsgegevens) announced the successful completion of their investigation into the security of Swift’s networks.