23.12.2011 EN Official Journal of the European Union L 343/140 COMMISSION IMPLEMENTING DECISION of 22 December 2011 on emergency measures regarding unauthorised genetically modified rice in rice products originating from China and repealing Decision 2008/289/EC (Text with EEA relevance) (2011/884/EU) THE EUROPEAN COMMISSION, Having regard to the Treaty on the Functioning of the European Union, Having regard to Regulation (EC) No 178/2002 of the European Parliament and of the Council of 28 January 2002 laying down the general principles and requirements of food law, establishing the European Food Safety Authority and laying down procedures in matters of food safety (1), and in particular Article 53(1) thereof, Whereas: (1) Articles 4(2) and 16(2) of Regulation (EC) No 1829/2003 of the European Parliament and of the Council of 22 September 2003 on genetically modified food and feed (2) provide that no genetically modified food or feed is to be placed on the Union market unless it is covered by an authorisation granted in accordance with that Regulation. Articles 4(3) and 16(3) of the same Regulation lay down that no genetically modified food and feed may be authorised unless it has been adequately and sufficiently demonstrated that it does not have adverse effects on human health, animal health or the environment, that it does not mislead the consumer or the user, and that it does not differ from the food or feed it is intended to replace to such an extent that its normal consumption would be nutritionally disadvantageous for humans or animals. (2) In September 2006, rice products originating in or consigned from China, contaminated with the unauthorised genetically modified rice Bt 63, were discovered in the United Kingdom, France and Germany and were notified to the Rapid Alert System for Food and Feed (RASFF). Notwithstanding the measures announced by the Chinese authorities to control the presence of that unauthorised Genetically Modified Organism (GMO), several other alerts concerning the presence of the unauthorised genetically modified rice Bt 63 were subsequently reported. (3) Considering the continuing alerts and the lack of sufficient guarantees from the Chinese competent authorities concerning the absence of the unauthorised genetically modified rice Bt 63 in products originating in or consigned from China, Commission Decision 2008/289/EC (3) was adopted which introduced emergency measures regarding the unauthorised GMO Bt 63 in rice products. That Decision required that prior to placing on the market, operators should submit an analytical report to the relevant Member State competent authorities demonstrating that the consignment of rice products was not contaminated with genetically modified rice Bt 63. Additionally, that Decision provided for Member States to take appropriate measures, including random sampling and analysis carried out using a specific method described therein, concerning products presented for importation or already on the market. (4) In March 2010, Germany notified the RASFF with regard to the presence of new rice varieties carrying unauthorised genetic elements encoding insect resistance which had characteristics similar to the GMO Kefeng 6. Subsequently, several additional similar alerts were notified, which in addition to Kefeng 6, also included the presence of another insect resistant rice line which contained genetic elements similar to the GMO Kemingdao 1 (KMD1). Kefeng 6 and KMD1 are not authorised either in the Union or China. (5) All RASFF notifications were notified to the relevant Chinese authorities and additionally the Commission wrote to the authorities both in June 2010 and February 2011 requesting action to address the increasing number of alerts. (6) The Food and Veterinary Office conducted an inspection in China in October 2008 with the objective of evaluating the implementation of Decision 2008/289/EC, which was subsequently followed up with another mission in March 2011. The conclusions of the 2008 mission and the initial findings of the 2011 mission indicated uncertainty as to the level, type and number of genetically modified rice varieties which may have contaminated rice products originating in or consigned from China, and that therefore there was a high risk of further introductions of unauthorised GMOs in such rice products. (7) In light of the findings of the 2008 and 2011 missions of the Food and Veterinary Office, and the numerous RASFF notifications concerning unauthorised genetically modified rice events, the measures provided by Decision 2008/289/EC should be enhanced accordingly so as to prevent any contaminated product being placed on the Union market. Therefore it is necessary to replace Decision 2008/289/EC by means of this Decision. (8) Taking into account the fact that no genetically modified rice products are authorised in the Union, it is appropriate to extend the scope of measures provided for by Decision 2008/289/EC, which is limited to genetically modified rice Bt 63, and to broaden it to all genetically modified organisms found in rice products originating in or consigned from China. The obligation to provide an analytical report on sampling and analysis demonstrating the absence of genetically modified rice events, established by Decision 2008/289/EC, should be maintained. However, it is appropriate to reinforce Member State controls through enhanced frequency of sampling and analysis which should be set at 100 % of all consignments of rice products originating from China, and to introduce the obligation for food and feed operators to give prior notification of the estimated date, time and place of the physical arrival of the consignment. (9) Sampling methodologies play a crucial role in obtaining representative and comparable results; it is therefore appropriate to define a common protocol for sampling and analysis for the control of the absence of genetically modified rice in imports originating from China. The principles for reliable sampling procedures for bulk agricultural commodities are laid down in Commission Recommendation 2004/787/EC of 4 October 2004 on technical guidance for sampling and detection of genetically modified organisms and material produced from genetically modified organisms as or in products in the context of Regulation (EC) No 1830/2003 (4) and for prepacked food in CEN/TS 15568 or equivalent. With regard to feed, such principles laid down in Commission Regulation (EC) No 152/2009 of 27 January 2009 laying down the methods of sampling and analysis for the official control of feed (5) shall apply. (10) Due to the number of potential genetically modified rice events, the lack of validated detection methods and control samples of adequate quality and quantity, and in order to facilitate controls, it is appropriate to replace the method for sampling and analysis provided for in the Decision 2008/289/EC with the analytical screening methods provided in Annex II. (11) The new proposed screening methods for analysis should be based on Recommendation 2004/787/EC. It particularly takes into account that currently available methods are qualitative and should address the detection of a unauthorised GMO for which there is no tolerance threshold for sampling and analysis. (12) The European Reference Laboratory for Genetically Modified Food and Feed (EU-RL GMFF) within the Joint Research Centre (JRC) verified and confirmed the suitability of the proposed screening methods for the detection of genetically modified rice. (13) For the purpose of the sampling and detecting activities required in order to prevent that products containing unauthorised rice events are placed on the market, it is necessary that both operators and official services follow such methods of sampling and analysis provided for in Annex II. In particular it is necessary that account is taken of the guidance provided by the EU-RL GMFF concerning the application of these methods. (14) Rice products, as listed in Annex I, originating in or consigned from China, should be released for free circulation only if they are accompanied by an analytical report and health certificate issued by the Entry Exit Inspection and Quarantine Bureau of the People’s Republic of China (AQSIQ) in accordance with the models laid down in Annex III and IV to this Decision. (15) In order to be able to have a continuous assessment of the control measures, it is appropriate to introduce an obligation for Member States to report regularly to the Commission concerning official controls on consignments of rice products originating or consigned from China. (16) The measures provided for in this Decision should be proportionate and no more restrictive of trade than is required and should therefore cover only products originating in or consigned from China and considered likely to be contaminated with unauthorised genetically modified rice events. Given the range of products that could be contaminated with such unauthorised genetically modified rice events, it seems appropriate to target all food and feed products which have rice listed as an ingredient. Some products, however, may or may not be containing, consisting or produced from rice. It seems therefore proportionate to allow operators to issue a simple declaration when the product is not containing, consisting or produced from rice, thus avoiding the compulsory analysis and certification. (17) The situation concerning the possible contamination of rice product with unauthorised genetically modified rice lines should be reviewed within 6 months in order to assess whether the measures provided for in this Decision are still necessary. (18) The measures provided for in this Decision are in accordance with the opinion of the Standing Committee on the Food Chain and Animal Health, HAS ADOPTED THIS DECISION: Article 1 Scope This Decision shall apply to rice products listed in Annex I, originating in or consigned from China. Article 2 Definitions 1. For the purposes of this Decision, the definitions laid down in Articles 2 and 3 of Regulation (EC) No 178/2002, Article 2 of Regulation (EC) No 882/2004 of the European Parliament and of the Council of 29 April 2004 on official controls performed to ensure the verification of compliance with feed and food law, animal health and animal welfare rules (6) and Article 3(b) and (c) of Commission Regulation (EC) No 669/2009 (7) on increased controls on imports of certain feed and food of non-animal origin shall apply. 2. The following definitions shall also apply: (a) Lot: a distinct and specified quantity of material. (b) Increment sample: small equal quantity of product taken from each individual sampling point in the lot through the full depth of the lot (static sampling), or taken from the product stream during a stated portion of time (flowing commodities sampling). (c) Bulk sample: quantity of product obtained by combining and mixing the increments taken from a specific lot. (d) Laboratory sample: quantity of product taken from the bulk sample intended for laboratory inspection and testing. (e) Analytical sample: homogenised laboratory sample, consisting either of the whole laboratory sample or a representative portion thereof. Article 3 Prior notification Feed and food business operators or their representatives shall give adequate prior notification of the estimated date and time at the designated point of entry of the physical arrival of the consignment and of the nature of the consignment. Operators must also indicate the designation of the product as to whether it is food or feed. Article 4 Import conditions 1. Each consignment of products referred to in Article 1 shall be accompanied by an analytical report for each lot, and by a health certificate in accordance with the models set out in Annexes III and IV, completed, signed and verified by an authorised representative of the ‘Entry Exit Inspection and Quarantine Bureau of the People’s Republic of China’ (AQSIQ). 2. Where a product referred to in Annex I is not containing, consisting of or produced from rice, the analytical report and the health certificate may be replaced by a statement from the operator responsible for the consignment indicating that the food or feed is not containing, consisting or produced from rice. 3. Sampling and analysis for the purposes of the analytical report referred to in paragraph 1 shall be performed in accordance with Annex II. 4. Each consignment shall be identified with the code appearing on the health certificate. Each individual bag, or other packaging form, of the consignment shall be identified with that code. Article 5 Official controls 1. The competent authority of a Member State shall ensure that all the products referred to in Article 1 are subject to documentary checks to ensure that the import conditions provided for in Article 4 are complied with. 2. Where a consignment of products other than those described in Article 4(2) is not accompanied by a health certificate and the analytical report provided for in Article 4, the consignment shall be re-dispatched to the country of origin or destroyed. 3. Where a consignment is accompanied by the health certificate and the analytical report provided for in Article 4 the competent authority shall take a sample for analysis in accordance with Annex II for the presence of unauthorised GMOs with a frequency of 100 %. If the consignment consists of several lots, each lot shall be submitted to sampling and analysis. 4. The competent authority may authorise onward transportation of the consignment pending the results of the physical checks. In such a case the consignment shall remain under the continuous control of the competent authorities pending the results of the physical checks. 5. The release for free circulation of consignments shall only be allowed when, following sampling and analyses performed in accordance with Annex II, all lots of that consignment are considered compliant with Union Law. Article 6 Reporting to the Commission 1. Member States shall prepare a report every 3 months, giving an account of all the results of all analytical tests carried out in the previous 3 months on consignments of the products referred to in Article 1. Those reports shall be submitted to the Commission during the month following each three-month period, in April, July, October, and January. 2. The report shall include the following information: (a) the number of consignments subjected to sampling for analysis; (b) the results of the checks as provided for in Article 5; (c) the number of consignments which have been rejected due to the absence of a health certificate or an analytical report. Article 7 Splitting of a consignment Consignments shall not be split until all official controls have been completed by the competent authorities. In the case of subsequent splitting following official control, an authenticated copy of the health certificate and the analytical report shall accompany each part of the split consignment. Article 8 Costs All costs resulting from the official controls including sampling, analysis, storage and any measures taken following non-compliance, shall be borne by the food and feed business operators. Article 9 Transitional provisions By way of derogation from Article 4(1), Member States shall authorise the imports of consignments of products referred to in Article 1 which left China prior to 1st of February 2012 provided that sampling and analysis has been conducted in accordance with the Article 4. Article 10 Review of the measure The measures provided for in this Decision shall be reviewed by the 6 months following adoption at the latest. Article 11 Repeal Decision 2008/289/EC is hereby repealed. References to the repealed Decision shall be construed as references to this Decision. Article 12 Entry into force This Decision shall enter into force on the 20th day following its publication in the Official Journal of the European Union. Done at Brussels, 22 December 2011. For the Commission The President José Manuel BARROSO (1) OJ L 31, 1.2.2002, p. 1. (2) OJ L 268, 18.10.2003, p. 1. (3) OJ L 96, 9.4.2008, p. 29. (4) OJ L 348, 24.11.2004, p. 18. (5) OJ L 54, 26.2.2009, p. 1. (6) OJ L 165, 30.4.2004, p. 1. (7) OJ L 194, 25.7.2009, p. 11. ANNEX I LIST OF PRODUCTS Product CN code Rice in the husk (‘paddy’ or rough) 1006 10 Husked (brown) rice 1006 20 Semi-milled or wholly milled rice, whether or not polished or glazed 1006 30 Broken rice 1006 40 00 Rice flour 1102 90 50 Rice groats and meal 1103 19 50 Rice pellets 1103 20 50 Flaked rice grains 1104 19 91 Rolled or flaked cereal grains (excluding grains of oats, wheat, rye, maize and barley, and flaked rice) 1104 19 99 Rice starch 1108 19 10 Preparations for infant use, put up for retail sale 1901 10 00 Uncooked pasta, not stuffed or otherwise prepared, containing eggs 1902 11 00 Uncooked pasta, not stuffed or otherwise prepared, not containing eggs 1902 19 Stuffed pasta, whether or not cooked or otherwise prepared 1902 20 Other pasta (other than uncooked pasta, not stuffed or otherwise prepared, and other than stuffed pasta, whether or not cooked or otherwise prepared) 1902 30 Prepared foods obtained by swelling or roasting cereals or cereal products, obtained from rice 1904 10 30 Preparations of the muesli-type based on unroasted cereal flakes 1904 20 10 Prepared foods obtained from unroasted cereal flakes or from mixtures of unroasted cereal flakes and roasted cereal flakes or swelled cereals, obtained from rice (excluding preparations of the muesli-type on the basis of unroasted cereal flakes) 1904 20 95 Rice, pre-cooked or otherwise prepared, not elsewhere specified or included (excluding flour, groats and meal, food preparations obtained by swelling or roasting or from unroasted cereal flakes or from mixtures of unroasted cereal flakes and roasted cereal flakes or swelled cereals) 1904 90 10 Ricepaper ex 1905 90 20 Biscuits 1905 90 45 Extruded or expanded products, savoury or salted 1905 90 55 Bran, sharps and other residues, whether or not in the form of pellets, derived from the sifting, milling or other working of rice with a starch content not exceeding 35 % by weight 2302 40 02 Bran, sharps and other residues, whether or not in the form of pellets, derived from the sifting, milling or other working of rice other than with a starch content not exceeding 35 % by weight 2302 40 08 Peptones and their derivatives; other protein substances and their derivatives, not elsewhere specified or included; hide powder, whether or not chromed 3504 00 00 ANNEX II Methods of sampling and analysis for official control regarding unauthorised genetically modified organism in rice products originating from China 1. General provisions Samples intended for the official control for the absence of GM rice in rice products shall be taken according to the methods described in this Annex. The bulk samples thus obtained shall be considered as representative of the lots from which they are taken. 2. Sampling 2.1. Sampling lots of bulk commodities and preparation of the analytical samples The number of incremental samples which make up the bulk sample and the preparation of the analytical samples shall be made in accordance with Recommendation 2004/787/EC and Regulation (EC) No 152/2009 for feed. The size of the laboratory sample shall be 2,5 kg but may be reduced to 500 grams for processed food or feed. For the purpose of Article 11(5) of Regulation (EC) No 882/2004, a second laboratory sample shall be constituted from the bulk sample. 2.2. Sampling of prepacked food and feed The number of incremental samples for the constitution of the bulk sample and the preparation of the analytical samples shall be made in accordance with CEN/ISO 15568 or equivalent. The size of the laboratory sample shall be 2,5 kg but may be reduced to 500 grams for processed food or feed. For the purpose of Article 11(5) of Regulation (EC) No 882/2004, a second laboratory sample shall be constituted from the bulk sample. 3. Analysis of the laboratory sample The laboratory analysis at the point of origin shall be carried out in a designated AQSIQ laboratory, and prior to release for free circulation in the Union in a Member State designated official control laboratory. Screening tests shall be performed by real-time PCR according to the method published by the EU-RL GMFF (1), for at least the following genetic elements: the CAMV (Cauliflower Mosaic Virus) 35S promoter, the NOS (nopaline synthase) terminator from Agrobacterium tumefaciens and the engineered CryIAb, CryIAc and/or CryIAb/CryIAc from Bacillus thuringiensis. In the case of grain samples the designated control laboratory shall take from the homogenised laboratory sample four analytical samples of 240 grams (equivalent 10 000 rice grains). For processed products such as flour, pasta or starch the analytical samples this may be reduced to 125 grams. The four analytical samples shall be ground and further analysed separately. Two extractions shall be made from each analytical sample. One PCR test for each GM genetic element shall be made for each extraction in accordance with the screening methods detailed under point 4 below. The consignment shall be considered non-compliant if at least one GM genetic element is considered detectable in at least one analytical sample of the consignment according to the guidelines provided in the EU-RL report. 4. The following analytical methods shall be used: (a) For screening for the CAMV (Cauliflower Mosaic Virus) 35S promoter and the NOS (nopaline synthase) terminator from Agrobacterium tumefaciens. ISO 21570: 2005 Methods of analysis for the detection of genetically modified organisms and derived products—quantitative nucleic acid based methods. Annex B1. H.-U. Waiblinger et al., (2008) ‘Validation and collaborative study of a P35S and T-nos duplex real-time screening method to detect genetically modified organisms in food products’ Eur. Food Res. and Technol., Volume 226, 1221-1228. E. Barbau-Piednoir et al., (2010) ‘SYBR®Green qPCR screening methods for the presence of “35S promoter” and “NOS terminator” elements in food and feed products’ Eur. Food Res. and Technol Volume 230, 383-393. Reiting R, Broll H, Waiblinger HU, Grohmann L (2007) Collaborative study of a T-nos real-time PCR method for screening of genetically modified organisms in food products. J Verbr Lebensm 2:116–121. (b) For screening for the engineered CryIAb, CryIAc and/or CryIAb/CryIAc from Bacillus thuringiensis. E. Barbau-Piednoir et al., (in press) ‘Four new SYBR®Green qPCR screening methods for the detection of Roundup Ready®, LibertyLink® and CryIAb traits in genetically modified products’ Eur. Food Res. and Technol DOI 10.1007/s00217-011-1605-7. Following verification of the specificity of the methods by the EU-RL GMFF on a wide variety of Chinese rice samples such method shall be considered as appropriate for these screening purposes. 5. The application of the above screening methods shall take into consideration the guidance document published by the EU RL GMFF. (1) http://gmo-crl.jrc.ec.europa.eu ANNEX III MODEL OF HEALTH CERTIFICATE ANNEX IV MODEL OF ANALYTICAL REPORT Note: please compile an annex form for each sample tested Parameter to be reported Information provided Name and address of the test laboratory (1) Test report identification code (1) <<000>> Laboratory sample identification code (1) <<000>> Size of laboratory sample (1) X kg In case of sample division: Number and size of analytical samples X analytical samples of Y g Number and size of test portions analysed (1) X test portions of Y mg Total DNA amount analysed (1) X ng/PCR DNA sequence(s) tested for (1): For each of the following provide reference to the method used and the average Ct number obtained Rice marker: 35S promoter: NOS terminator: CryIAb/CryIAc: Other sequence(s) tested for: Validation status: (e.g. inter-laboratory validated, in-house validated [please indicate according to which standard, guideline]) Description of DNA sequences detected (reference + target genes): Specificity of the method (screening, construct-specific or event-specific): Absolute Limit of Detection (copy number): Practical Limit of Detection (LOD related to the sample analysed), if determined: Description of positive controls for target DNA, and reference materials (1) Source and nature of the positive control and reference materials (e.g. plasmid, genomic DNA, CRM …) Information on the positive control (1) Please indicate the amount (in ng DNA) of positive control analysed and the average Ct number obtained Comments (1) Obligatory fields

Summary: Unauthorised genetically modified rice in rice products from China — emergency measures Unauthorised genetically modified rice in rice products from China — emergency measures SUMMARY OF: Implementing Decision 2011/884/EU — emergency measures regarding unauthorised genetically modified rice in rice products originating from China WHAT IS THE AIM OF THE DECISION? It sets out emergency measures regarding genetically modified (GM) rice in rice products originating or consigned from China. It establishes a common sampling and analysis protocol to detect the presence of GM rice in such imports. KEY POINTS Prior notification Feed and food businesses must: give adequate prior notification of the nature of the consignment and of the estimated date and time at the designated point of entry of its physical arrival; indicate whether the product is food or animal feed. Import conditions Each consignment of products must be accompanied by an analytical report for each lot and by a health certificate completed, signed and verified by an authorised representative of the Administration of Quality Supervision, Inspection and Quarantine of the People’s Republic of China. If a product does not contain, consist of or is not produced from rice, the report and certificate may be replaced by a statement from the operator responsible for the consignment indicating this fact. Each consignment must be identified with the code appearing on the health certificate. Each individual bag or other packaging form of the consignment must be identified with that code. Official controls The competent national authority must ensure that documents of each consignment are checked to certify that the import conditions for all such products are complied with. If a consignment of rice products is not accompanied by a health certificate or the analytical report, the consignment must be re-dispatched to the country of origin or destroyed. If a consignment is accompanied by the health certificate and the analytical report, the authority must take a sample to analyse the presence of unauthorised GM rice. If the consignment consists of several lots, each lot must be sampled and analysed. Onward transport of the consignment can be authorised pending the results of the physical checks. However, during this time, it must remain under the continuous control of the competent authorities. Free circulation of consignments is only permitted after the results of the physical tests are provided and if all the lots comply with EU law. Reports Every 3 months EU countries must each send a report to the European Commission giving an account of the results of all analytical tests carried out in the previous 3 months. The report must include the following information: the number of consignments subjected to sampling for analysis; the results of the checks undertaken; the number of consignments rejected for lack of a health certificate or analytical report. FROM WHEN DOES THE DECISION APPLY? It has applied since 12 January 2012. BACKGROUND For more information, see: Genetically modified organisms (European Commission). MAIN DOCUMENT Commission Implementing Decision 2011/884/EU of 22 December 2011 on emergency measures regarding unauthorised genetically modified rice in rice products originating from China and repealing Decision 2008/289/EC (OJ L 343, 23.12.2011, pp. 140-148) Successive amendments to Decision 2011/884/EU have been incorporated into the original text. This consolidated version is of documentary value only. RELATED DOCUMENTS Commission Implementing Decision 2013/287/EU of 13 June 2013 amending Implementing Decision 2011/884/EU on emergency measures regarding unauthorised genetically modified rice in rice products originating from China (OJ L 162, 14.6.2013, pp. 10-14) Regulation (EC) No 1829/2003 of the European Parliament and of the Council of 22 September 2003 on genetically modified food and feed (OJ L 268, 18.10.2003, pp. 1-23) See consolidated version. last update 18.12.2017


27.7.2010 EN Official Journal of the European Union L 195/3 COUNCIL DECISION of 13 July 2010 on the conclusion of the Agreement between the European Union and the United States of America on the processing and transfer of Financial Messaging Data from the European Union to the United States for the purposes of the Terrorist Finance Tracking Program (2010/412/EU) THE COUNCIL OF THE EUROPEAN UNION, Having regard to the Treaty on the Functioning of the European Union, and in particular Articles 87(2)(a) and 88(2), in conjunction with Article 218(6)(a) thereof, Having regard to the proposal from the European Commission, Having regard to the consent of the European Parliament, Whereas: (1) By decision of 11 May 2010, the Council authorised the Commission to open negotiations on behalf of the European Union between the Union and the United States to make available to the United States Treasury Department financial messaging data to prevent and combat terrorism and terrorism financing. (2) In accordance with Council Decision 2010/411/EU of 28 June 2010 (1) the Agreement between the European Union and the United States of America on the processing and transfer of Financial Messaging Data from the European Union to the United States for the purposes of the Terrorist Finance Tracking Program (the Agreement) was signed on 28 June 2010, subject to its conclusion at a later date. (3) The Agreement should be concluded. (4) The Agreement respects the fundamental rights and observes the principles recognised in particular in the Charter of Fundamental Rights of the European Union, notably the right to private and family life, recognised in Article 7 of the Charter, the right to the protection of personal data, recognised in Article 8 of the Charter and the right to effective remedy and fair trial recognised in Article 47 of the Charter. The Agreement should be applied in accordance with those rights and principles. (5) In accordance with Article 3 of Protocol No 21 on the position of the United Kingdom and Ireland in respect of the Area of Freedom, Security and Justice, annexed to the Treaty on European Union and to the Treaty on the Functioning of the European Union, the United Kingdom has notified its wish to take part in the adoption and application of this Decision. (6) In accordance with Articles 1 and 2 of Protocol No 21 on the position of the United Kingdom and Ireland in respect of the Area of Freedom, Security and Justice, annexed to the Treaty on European Union and to the Treaty on the Functioning of the European Union and without prejudice to Article 4 of that Protocol, Ireland is not taking part in the adoption of this Decision and is not bound by it or subject to its application. (7) In accordance with Articles 1 and 2 of Protocol No 22 on the position of Denmark annexed to the Treaty on European Union and to the Treaty on the Functioning of the European Union, Denmark is not taking part in the adoption of this Decision and is not bound by it or subject to its application, HAS ADOPTED THIS DECISION: Article 1 The Agreement between the European Union and the United States of America on the processing and transfer of Financial Messaging Data from the European Union to the United States for the purposes of the Terrorist Finance Tracking Program (the Agreement) is hereby approved on behalf of the Union (2). The text of the Agreement is attached to this Decision. Article 2 The Commission is invited to submit to the European Parliament and the Council, no later than one year from the date of entry into force of the Agreement, a legal and technical framework for the extraction of data on EU territory. Within three years from the date of entry into force of the Agreement, the Commission is invited to present a report of progress on the development of the equivalent EU system with regard to Article 11 of the Agreement. If, five years after the date of entry into force of the Agreement, the equivalent EU system has not been set up, the Union shall consider whether to renew the Agreement in accordance with Article 21(2) thereof. Article 3 The President of the Council shall designate the person(s) empowered to proceed, on behalf of the Union, to the exchange of the instruments of approval provided for in Article 23 of the Agreement, in order to express the consent of the Union to be bound. Article 4 This Decision shall enter into force on the day of its adoption. Done at Brussels, 13 July 2010. For the Council The President D. REYNDERS (1) See page 5 of this Official Journal. (2) The date of entry into force of the Agreement shall be published in the Official Journal of the European Union by the General Secretariat of the Council. 27.7.2010 EN Official Journal of the European Union L 195/3 AGREEMENT between the European Union and the United States of America on the processing and transfer of Financial Messaging Data from the European Union to the United States for the purposes of the Terrorist Finance Tracking Program THE EUROPEAN UNION, of the one part, and THE UNITED STATES OF AMERICA, of the other part, Together hereinafter referred to as ‘the Parties’, DESIRING to prevent and combat terrorism and its financing, in particular by mutual sharing of information, as a means of protecting their respective democratic societies and common values, rights, and freedoms; SEEKING to enhance and encourage cooperation between the Parties in the spirit of transatlantic partnership; RECALLING the United Nations conventions for combating terrorism and its financing, and relevant resolutions of the United Nations Security Council in the field of fighting terrorism, in particular United Nations Security Council Resolution 1373 (2001) and its directives that all States shall take the necessary steps to prevent the commission of terrorist acts, including by provision of early warning to other States by exchange of information; that States shall afford one another the greatest measure of assistance in connection with criminal investigations or criminal proceedings relating to the financing or support of terrorist acts; that States should find ways of intensifying and accelerating the exchange of operational information; that States should exchange information in accordance with international and domestic law; and that States should cooperate, particularly through bilateral and multilateral arrangements and agreements, to prevent and suppress terrorist attacks and to take action against perpetrators of such attacks; RECOGNISING that the United States Department of the Treasury’s (U.S. Treasury Department) Terrorist Finance Tracking Program (TFTP) has been instrumental in identifying and capturing terrorists and their financiers and has generated many leads that have been disseminated for counter terrorism purposes to competent authorities around the world, with particular value for European Union Member States (Member States); NOTING the importance of the TFTP in preventing and combating terrorism and its financing in the European Union and elsewhere, and the important role of the European Union in ensuring that designated providers of international financial payment messaging services provide financial payment messaging data stored in the territory of the European Union which are necessary for preventing and combating terrorism and its financing, subject to strict compliance with safeguards on privacy and the protection of personal data; MINDFUL of Article 6(2) of the Treaty on European Union on respect for fundamental rights, the right to privacy with regard to the processing of personal data as stipulated in Article 16 of the Treaty on the Functioning of the European Union, the principles of proportionality and necessity concerning the right to private and family life, the respect for privacy, and the protection of personal data under Article 8(2) of the European Convention on the Protection of Human Rights and Fundamental Freedoms, Council of Europe Convention No 108 for the Protection of Individuals with regard to Automatic Processing of Personal Data, and Articles 7 and 8 of the Charter of Fundamental Rights of the European Union; MINDFUL of the breadth of privacy protections in the United States of America (United States), as reflected in the United States Constitution, and in its criminal and civil legislation, regulations, and long-standing policies, which are enforced and maintained by checks and balances applied by the three branches of government; STRESSING the common values governing privacy and the protection of personal data in the European Union and the United States, including the importance which both Parties assign to due process and the right to seek effective remedies for improper government action; MINDFUL of the mutual interest in the expeditious conclusion of a binding agreement between the European Union and the United States based on common principles regarding the protection of personal data when transferred for the general purposes of law enforcement, bearing in mind the importance of carefully considering its effect on prior agreements and the principle of effective administrative and judicial redress on a non-discriminatory basis; NOTING the rigorous controls and safeguards utilised by the U.S. Treasury Department for the handling, use, and dissemination of financial payment messaging data pursuant to the TFTP, as described in the representations of the U.S. Treasury Department published in the Official Journal of the European Union on 20 July 2007 and the Federal Register of the United States on 23 October 2007, which reflect the ongoing cooperation between the United States and the European Union in the fight against global terrorism; RECOGNISING the two comprehensive reviews and reports of the independent person appointed by the European Commission to verify compliance with the data protection safeguards of the TFTP, concluding that the United States was complying with the data privacy protection practices outlined in its Representations and further that the TFTP has generated significant security benefits for the European Union and has been extremely valuable not only in investigating terrorist attacks but also in preventing a number of terrorist attacks in Europe and elsewhere; MINDFUL of the European Parliament’s resolution of 5 May 2010 on the Recommendation from the Commission to the Council to authorise the opening of negotiations for an agreement between the European Union and the United States to make available to the U.S. Treasury Department financial messaging data to prevent and combat terrorism and terrorist financing; RECALLING that, to guarantee effective exercise of their rights, any person irrespective of nationality is able to lodge a complaint before an independent data protection authority, other similar authority, or independent and impartial court or tribunal, to seek effective remedies; MINDFUL that non-discriminatory administrative and judicial redress is available under U.S. law for the mishandling of personal data, including under the Administrative Procedure Act of 1946, the Inspector General Act of 1978, the Implementing Recommendations of the 9/11 Commission Act of 2007, the Computer Fraud and Abuse Act, and the Freedom of Information Act; RECALLING that by law within the European Union customers of financial institutions and of providers of financial payment messaging services are informed in writing that personal data contained in financial transaction records may be transferred to Member States’ or third countries’ public authorities for law enforcement purposes and that this notice may include information with respect to the TFTP; RECOGNISING the principle of proportionality guiding this Agreement and implemented by both the European Union and the United States; in the European Union as derived from the European Convention on Human Rights and Fundamental Freedoms, its applicable jurisprudence, and EU and Member State legislation; and in the United States through reasonableness requirements derived from the United States Constitution and federal and state laws, and their interpretive jurisprudence, as well as through prohibitions on overbreadth of production orders and on arbitrary action by government officials; AFFIRMING that this Agreement does not constitute a precedent for any future arrangements between the United States and the European Union, or between either of the Parties and any State, regarding the processing and transfer of financial payment messaging data or any other form of data, or regarding data protection; RECOGNISING that Designated Providers are bound by generally applicable EU or national data protection rules, intended to protect individuals with regard to the processing of their personal data, under the supervision of competent Data Protection Authorities in a manner consistent with the specific provisions of this Agreement; and FURTHER AFFIRMING that this Agreement is without prejudice to other law enforcement or information sharing agreements or arrangements between the Parties or between the United States and Member States, HAVE AGREED AS FOLLOWS: Article 1 Purpose of Agreement 1. The purpose of this Agreement is to ensure, with full respect for the privacy, protection of personal data, and other conditions set out in this Agreement, that: (a) financial payment messages referring to financial transfers and related data stored in the territory of the European Union by providers of international financial payment messaging services, that are jointly designated pursuant to this Agreement, are provided to the U.S. Treasury Department for the exclusive purpose of the prevention, investigation, detection, or prosecution of terrorism or terrorist financing; and (b) relevant information obtained through the TFTP is provided to law enforcement, public security, or counter terrorism authorities of Member States, or Europol or Eurojust, for the purpose of the prevention, investigation, detection, or prosecution of terrorism or terrorist financing. 2. The United States, the European Union, and its Member States shall take all necessary and appropriate measures within their authority to carry out the provisions and achieve the purpose of this Agreement. Article 2 Scope of application This Agreement applies to the obtaining and use of financial payment messaging and related data with a view to the prevention, investigation, detection, or prosecution of: (a) acts of a person or entity that involve violence, or are otherwise dangerous to human life or create a risk of damage to property or infrastructure, and which, given their nature and context, are reasonably believed to be committed with the aim of: (i) intimidating or coercing a population; (ii) intimidating, compelling, or coercing a government or international organisation to act or abstain from acting; or (iii) seriously destabilising or destroying the fundamental political, constitutional, economic, or social structures of a country or an international organisation; (b) a person or entity assisting, sponsoring, or providing financial, material, or technological support for, or financial or other services to or in support of, acts described in subparagraph (a); (c) a person or entity providing or collecting funds, by any means, directly or indirectly, with the intention that they should be used or in the knowledge that they are to be used, in full or in part, in order to carry out any of the acts described in subparagraphs (a) or (b); or (d) a person or entity aiding, abetting, or attempting acts described in subparagraphs (a), (b), or (c). Article 3 Ensuring provision of data by Designated Providers The Parties, jointly and individually, shall ensure, in accordance with this Agreement and in particular Article 4, that entities jointly designated by the Parties under this Agreement as providers of international financial payment messaging services (Designated Providers) provide to the U.S. Treasury Department requested financial payment messaging and related data which are necessary for the purpose of the prevention, investigation, detection, or prosecution of terrorism or terrorist financing (Provided Data). The Designated Providers shall be identified in the Annex to this Agreement and may be updated, as necessary, by exchange of diplomatic notes. Any amendments to the Annex shall be duly published in the Official Journal of the European Union. Article 4 U.S. Requests to obtain data from Designated Providers 1. For the purposes of this Agreement, the U.S. Treasury Department shall serve production orders (Requests), under authority of U.S. law, upon a Designated Provider present in the territory of the United States in order to obtain data necessary for the purpose of the prevention, investigation, detection, or prosecution of terrorism or terrorist financing that are stored in the territory of the European Union. 2. The Request (together with any supplemental documents) shall: (a) identify as clearly as possible the data, including the specific categories of data requested, that are necessary for the purpose of the prevention, investigation, detection, or prosecution of terrorism or terrorist financing; (b) clearly substantiate the necessity of the data; (c) be tailored as narrowly as possible in order to minimise the amount of data requested, taking due account of past and current terrorism risk analyses focused on message types and geography as well as perceived terrorism threats and vulnerabilities, geographic, threat, and vulnerability analyses; and (d) not seek any data relating to the Single Euro Payments Area. 3. Upon service of the Request on the Designated Provider, the U.S. Treasury Department shall simultaneously provide a copy of the Request, with any supplemental documents, to Europol. 4. Upon receipt of the copy, Europol shall verify as a matter of urgency whether the Request complies with the requirements of paragraph 2. Europol shall notify the Designated Provider that it has verified that the Request complies with the requirements of paragraph 2. 5. For the purposes of this Agreement, once Europol has confirmed that the Request complies with the requirements of paragraph 2, the Request shall have binding legal effect as provided under U.S. law, within the European Union as well as the United States. The Designated Provider is thereby authorised and required to provide the data to the U.S. Treasury Department. 6. The Designated Provider shall thereupon provide the data (i.e., on a ‘push basis’) directly to the U.S. Treasury Department. The Designated Provider shall keep a detailed log of all data transmitted to the U.S. Treasury Department for the purposes of this Agreement. 7. Once the data have been provided pursuant to these procedures, the Designated Provider shall be deemed to have complied with this Agreement and with all other applicable legal requirements in the European Union related to the transfer of such data from the European Union to the United States. 8. Designated Providers shall have all administrative and judicial redress available under U.S. law to recipients of U.S. Treasury Department Requests. 9. The Parties shall jointly coordinate with regard to the technical modalities necessary to support the Europol verification process. Article 5 Safeguards applicable to the processing of Provided Data 1. The U.S. Treasury Department shall ensure that Provided Data are processed in accordance with the provisions of this Agreement. The U.S. Treasury Department shall ensure the protection of personal data by means of the following safeguards, which shall be applied without discrimination, in particular on the basis of nationality or country of residence. 2. Provided Data shall be processed exclusively for the prevention, investigation, detection, or prosecution of terrorism or its financing. 3. The TFTP does not and shall not involve data mining or any other type of algorithmic or automated profiling or computer filtering. 4. To prevent unauthorised access to or disclosure or loss of the data or any unauthorised form of processing: (a) Provided Data shall be held in a secure physical environment, stored separately from any other data, and maintained with high-level systems and physical intrusion controls; (b) Provided Data shall not be interconnected with any other database; (c) access to Provided Data shall be limited to analysts investigating terrorism or its financing and to persons involved in the technical support, management, and oversight of the TFTP; (d) Provided Data shall not be subject to any manipulation, alteration, or addition; and (e) no copies of Provided Data shall be made, other than for disaster recovery back-up purposes. 5. All searches of Provided Data shall be based upon pre-existing information or evidence which demonstrates a reason to believe that the subject of the search has a nexus to terrorism or its financing. 6. Each individual TFTP search of Provided Data shall be narrowly tailored, shall demonstrate a reason to believe that the subject of the search has a nexus to terrorism or its financing, and shall be logged, including such nexus to terrorism or its financing required to initiate the search. 7. Provided Data may include identifying information about the originator and/or recipient of a transaction, including name, account number, address, and national identification number. The Parties recognise the special sensitivity of personal data revealing racial or ethnic origin, political opinions, or religious or other beliefs, trade union membership, or health and sexual life (sensitive data). In the exceptional circumstance that extracted data were to include sensitive data, the U.S. Treasury Department shall protect such data in accordance with the safeguards and security measures set forth in this Agreement and with full respect and taking due account of their special sensitivity. Article 6 Retention and deletion of data 1. During the term of this Agreement, the U.S. Treasury Department shall undertake an ongoing and at least annual evaluation to identify non-extracted data that are no longer necessary to combat terrorism or its financing. Where such data are identified, the U.S. Treasury Department shall permanently delete them as soon as technologically feasible. 2. If it transpires that financial payment messaging data were transmitted which were not requested, the U.S. Treasury Department shall promptly and permanently delete such data and shall inform the relevant Designated Provider. 3. Subject to any earlier deletion of data resulting from paragraphs 1, 2, or 5, all non-extracted data received prior to 20 July 2007 shall be deleted not later than 20 July 2012. 4. Subject to any earlier deletion of data resulting from paragraphs 1, 2, or 5, all non-extracted data received on or after 20 July 2007 shall be deleted not later than five (5) years from receipt. 5. During the term of this Agreement, the U.S. Treasury Department shall undertake an ongoing and at least annual evaluation to assess the data retention periods specified in paragraphs 3 and 4 to ensure that they continue to be no longer than necessary to combat terrorism or its financing. Where any such retention periods are determined to be longer than necessary to combat terrorism or its financing, the U.S. Treasury Department shall reduce such retention periods, as appropriate. 6. Not later than three years from the date of entry into force of this Agreement, the European Commission and the U.S. Treasury Department shall prepare a joint report regarding the value of TFTP Provided Data, with particular emphasis on the value of data retained for multiple years and relevant information obtained from the joint review conducted pursuant to Article 13. The Parties shall jointly determine the modalities of this report. 7. Information extracted from Provided Data, including information shared under Article 7, shall be retained for no longer than necessary for specific investigations or prosecutions for which they are used. Article 7 Onward transfer Onward transfer of information extracted from the Provided Data shall be limited pursuant to the following safeguards: (a) only information extracted as a result of an individualised search as described in this Agreement, in particular Article 5, shall be shared; (b) such information shall be shared only with law enforcement, public security, or counter terrorism authorities in the United States, Member States, or third countries, or with Europol or Eurojust, or other appropriate international bodies, within the remit of their respective mandates; (c) such information shall be shared for lead purposes only and for the exclusive purpose of the investigation, detection, prevention, or prosecution of terrorism or its financing; (d) where the U.S. Treasury Department is aware that such information involves a citizen or resident of a Member State, any sharing of the information with the authorities of a third country shall be subject to the prior consent of competent authorities of the concerned Member State or pursuant to existing protocols on such information sharing between the U.S. Treasury Department and that Member State, except where the sharing of the data is essential for the prevention of an immediate and serious threat to public security of a Party to this Agreement, a Member State, or a third country. In the latter case the competent authorities of the concerned Member State shall be informed of the matter at the earliest opportunity; (e) in sharing such information, the U.S. Treasury Department shall request that the information shall be deleted by the recipient authority as soon as it is no longer necessary for the purpose for which it was shared; and (f) each onward transfer shall be duly logged. Article 8 Adequacy Subject to ongoing compliance with the commitments on privacy and protection of personal data set out in this Agreement, the U.S. Treasury Department is deemed to ensure an adequate level of data protection for the processing of financial payment messaging and related data transferred from the European Union to the United States for the purposes of this Agreement. Article 9 Spontaneous provision of information 1. The U.S. Treasury Department shall ensure the availability, as soon as practicable and in the most expedient manner, to law enforcement, public security, or counter terrorism authorities of concerned Member States, and, as appropriate, to Europol and Eurojust, within the remit of their respective mandates, of information obtained through the TFTP that may contribute to the investigation, prevention, detection, or prosecution by the European Union of terrorism or its financing. Any follow-on information that may contribute to the investigation, prevention, detection, or prosecution by the United States of terrorism or its financing shall be conveyed back to the United States on a reciprocal basis and in a reciprocal manner. 2. In order to facilitate the efficient exchange of information, Europol may designate a liaison officer to the U.S. Treasury Department. The modalities of the liaison officer’s status and tasks shall be decided jointly by the Parties. Article 10 EU requests for TFTP searches Where a law enforcement, public security, or counter terrorism authority of a Member State, or Europol or Eurojust, determines that there is reason to believe that a person or entity has a nexus to terrorism or its financing as defined in Articles 1 to 4 of Council Framework Decision 2002/475/JHA, as amended by Council Framework Decision 2008/919/JHA and Directive 2005/60/EC, such authority may request a search for relevant information obtained through the TFTP. The U.S. Treasury Department shall promptly conduct a search in accordance with Article 5 and provide relevant information in response to such requests. Article 11 Cooperation with future equivalent EU system 1. During the course of this Agreement, the European Commission will carry out a study into the possible introduction of an equivalent EU system allowing for a more targeted transfer of data. 2. If, following this study, the European Union decides to establish an EU system, the United States shall cooperate and provide assistance and advice to contribute to the effective establishment of such a system. 3. Since the establishment of an EU system could substantially change the context of this Agreement, if the European Union decides to establish such a system, the Parties should consult to determine whether this Agreement would need to be adjusted accordingly. In that regard, U.S. and EU authorities shall cooperate to ensure the complementariness and efficiencies of the U.S. and EU systems in a manner that further enhances the security of citizens of the United States, the European Union, and elsewhere. In the spirit of this cooperation, the Parties shall actively pursue, on the basis of reciprocity and appropriate safeguards, the cooperation of any relevant international financial payment messaging service providers which are based in their respective territories for the purposes of ensuring the continued and effective viability of the U.S. and EU systems. Article 12 Monitoring of safeguards and controls 1. Compliance with the strict counter terrorism purpose limitation and the other safeguards set out in Articles 5 and 6 shall be subject to monitoring and oversight by independent overseers, including by a person appointed by the European Commission, with the agreement of and subject to appropriate security clearances by the United States. Such oversight shall include the authority to review in real time and retrospectively all searches made of the Provided Data, the authority to query such searches and, as appropriate, to request additional justification of the terrorism nexus. In particular, independent overseers shall have the authority to block any or all searches that appear to be in breach of Article 5. 2. The oversight described in paragraph 1 shall be subject to regular monitoring, including of the independence of the oversight described in paragraph 1, in the framework of the review foreseen in Article 13. The Inspector General of the U.S. Treasury Department will ensure that the independent oversight described in paragraph 1 is undertaken pursuant to applicable audit standards. Article 13 Joint review 1. At the request of one of the Parties and at any event after a period of six (6) months from the date of entry into force of this Agreement, the Parties shall jointly review the safeguards, controls, and reciprocity provisions set out in this Agreement. The review shall be conducted thereafter on a regular basis, with additional reviews scheduled as necessary. 2. The review shall have particular regard to (a) the number of financial payment messages accessed, (b) the number of occasions on which leads have been shared with Member States, third countries, and Europol and Eurojust, (c) the implementation and effectiveness of this Agreement, including the suitability of the mechanism for the transfer of information, (d) cases in which the information has been used for the prevention, investigation, detection, or prosecution of terrorism or its financing, and (e) compliance with data protection obligations specified in this Agreement. The review shall include a representative and random sample of searches in order to verify compliance with the safeguards and controls set out in this Agreement, as well as a proportionality assessment of the Provided Data, based on the value of such data for the investigation, prevention, detection, or prosecution of terrorism or its financing. Following the review, the European Commission will present a report to the European Parliament and the Council on the functioning of this Agreement, including the areas mentioned in this paragraph. 3. For the purposes of the review, the European Union shall be represented by the European Commission, and the United States shall be represented by the U.S. Treasury Department. Each Party may include in its delegation for the review experts in security and data protection, as well as a person with judicial experience. The European Union review delegation shall include representatives of two data protection authorities, at least one of which shall be from a Member State where a Designated Provider is based. 4. For the purposes of the review, the U.S. Treasury Department shall ensure access to relevant documentation, systems, and personnel. The Parties shall jointly determine the modalities of the review. Article 14 Transparency — providing information to the data subjects The U.S. Treasury Department shall post on its public website detailed information concerning the TFTP and its purposes, including contact information for persons with questions. In addition, it shall post information about the procedures available for the exercise of the rights described in Articles 15 and 16, including the availability of administrative and judicial redress as appropriate in the United States regarding the processing of personal data received pursuant to this Agreement. Article 15 Right of access 1. Any person has the right to obtain, following requests made at reasonable intervals, without constraint and without excessive delay, at least a confirmation transmitted through his or her data protection authority in the European Union as to whether that person’s data protection rights have been respected in compliance with this Agreement, after all necessary verifications have taken place, and, in particular, whether any processing of that person’s personal data has taken place in breach of this Agreement. 2. Disclosure to a person of his or her personal data processed under this Agreement may be subject to reasonable legal limitations applicable under national law to safeguard the prevention, detection, investigation, or prosecution of criminal offences, and to protect public or national security, with due regard for the legitimate interest of the person concerned. 3. Pursuant to paragraph 1, a person shall send a request to his or her European national supervisory authority, which shall transmit the request to the Privacy Officer of the U.S. Treasury Department, who shall make all necessary verifications pursuant to the request. The Privacy Officer of the U.S. Treasury Department shall without undue delay inform the relevant European national supervisory authority whether personal data may be disclosed to the data subject and whether the data subject’s rights have been duly respected. In the case that access to personal data is refused or restricted pursuant to the limitations referred to in paragraph 2, such refusal or restriction shall be explained in writing and provide information on the means available for seeking administrative and judicial redress in the United States. Article 16 Right to rectification, erasure, or blocking 1. Any person has the right to seek the rectification, erasure, or blocking of his or her personal data processed by the U.S. Treasury Department pursuant to this Agreement where the data are inaccurate or the processing contravenes this Agreement. 2. Any person exercising the right expressed in paragraph 1 shall send a request to his or her relevant European national supervisory authority, which shall transmit the request to the Privacy Officer of the U.S. Treasury Department. Any request to obtain rectification, erasure, or blocking shall be duly substantiated. The Privacy Officer of the U.S. Treasury Department shall make all necessary verifications pursuant to the request and shall without undue delay inform the relevant European national supervisory authority whether personal data have been rectified, erased, or blocked, and whether the data subject’s rights have been duly respected. Such notification shall be explained in writing and provide information on the means available for seeking administrative and judicial redress in the United States. Article 17 Maintaining the accuracy of information 1. Where a Party becomes aware that data received or transmitted pursuant to this Agreement are not accurate, it shall take all appropriate measures to prevent and discontinue erroneous reliance on such data, which may include supplementation, deletion, or correction of such data. 2. Each Party shall, where feasible, notify the other if it becomes aware that material information it has transmitted to or received from the other Party under this Agreement is inaccurate or unreliable. Article 18 Redress 1. The Parties shall take all reasonable steps to ensure that the U.S. Treasury Department and any relevant Member State promptly inform one another, and consult with one another and the Parties, if necessary, where they consider that personal data have been processed in breach of this Agreement. 2. Any person who considers his or her personal data to have been processed in breach of this Agreement is entitled to seek effective administrative and judicial redress in accordance with the laws of the European Union, its Member States, and the United States, respectively. For this purpose and as regards data transferred to the United States pursuant to this Agreement, the U.S. Treasury Department shall treat all persons equally in the application of its administrative process, regardless of nationality or country of residence. All persons, regardless of nationality or country of residence, shall have available under U.S. law a process for seeking judicial redress from an adverse administrative action. Article 19 Consultation 1. The Parties shall, as appropriate, consult each other to enable the most effective use to be made of this Agreement, including to facilitate the resolution of any dispute regarding the interpretation or application of this Agreement. 2. The Parties shall take measures to avoid the imposition of extraordinary burdens on one another through application of this Agreement. Where extraordinary burdens nonetheless result, the Parties shall immediately consult with a view to facilitating the application of this Agreement, including the taking of such measures as may be required to reduce pending and future burdens. 3. The Parties shall immediately consult in the event that any third party, including an authority of another country, challenges or asserts a legal claim with respect to any aspect of the effect or implementation of this Agreement. Article 20 Implementation and non-derogation 1. This Agreement shall not create or confer any right or benefit on any person or entity, private or public. Each Party shall ensure that the provisions of this Agreement are properly implemented. 2. Nothing in this Agreement shall derogate from existing obligations of the United States and Member States under the Agreement on Mutual Legal Assistance between the European Union and the United States of America of 25 June 2003 and the related bilateral mutual legal assistance instruments between the United States and Member States. Article 21 Suspension or termination 1. Either Party may suspend the application of this Agreement with immediate effect, in the event of breach of the other Party’s obligations under this Agreement, by notification through diplomatic channels. 2. Either Party may terminate this Agreement at any time by notification through diplomatic channels. Termination shall take effect six (6) months from the date of receipt of such notification. 3. The Parties shall consult prior to any possible suspension or termination in a manner which allows a sufficient time for reaching a mutually agreeable resolution. 4. Notwithstanding any suspension or termination of this Agreement, all data obtained by the U.S. Treasury Department under the terms of this Agreement shall continue to be processed in accordance with the safeguards of this Agreement, including the provisions on deletion of data. Article 22 Territorial application 1. Subject to paragraphs 2 to 4, this Agreement shall apply to the territory in which the Treaty on European Union and the Treaty on the Functioning of the European Union are applicable and to the territory of the United States. 2. This Agreement will only apply to Denmark, the United Kingdom, or Ireland if the European Commission notifies the United States in writing that Denmark, the United Kingdom, or Ireland has chosen to be bound by this Agreement. 3. If the European Commission notifies the United States before the entry into force of this Agreement that it will apply to Denmark, the United Kingdom, or Ireland, this Agreement shall apply to the territory of such State on the same day as for the other EU Member States bound by this Agreement. 4. If the European Commission notifies the United States after the entry into force of this Agreement that it applies to Denmark, the United Kingdom, or Ireland, this Agreement shall apply to the territory of such State on the first day of the month following receipt of the notification by the United States. Article 23 Final provisions 1. This Agreement shall enter into force on the first day of the month after the date on which the Parties have exchanged notifications indicating that they have completed their internal procedures for this purpose. 2. Subject to Article 21, paragraph 2, this Agreement shall remain in force for a period of five (5) years from the date of its entry into force and shall automatically extend for subsequent periods of one (1) year unless one of the Parties notifies the other in writing through diplomatic channels, at least six (6) months in advance, of its intention not to extend this Agreement. Done at Brussels, on 28 June 2010, in two originals, in the English language. This Agreement shall also be drawn up in the Bulgarian, Czech, Danish, Dutch, Estonian, Finnish, French, German, Greek, Hungarian, Italian, Latvian, Lithuanian, Maltese, Polish, Portuguese, Romanian, Slovak, Slovenian, Spanish, and Swedish languages. Upon approval by both Parties, these language versions shall be considered equally authentic. За Европейския съюз Por la Unión Europea Za Evropskou unii For Den Europæiske Union Für die Europäische Union Euroopa Liidu nimel Για την Ευρωπαϊκή Ένωση For the European Union Pour l’Union européenne Per l’Unione europea Eiropas Savienības vārdā Europos Sajungos vardu Az Európai Unió részéről Għall-Unjoni Ewropea Voor de Europese Unie W imieniu Unii Europejskiej Pela União Europeia Peuntu Uniunea Europeană Za Európsku úniu Za Evropsko unijo Euroopan unionin puolesta För Europeiska unionen За Съединените американски щати Por los Estados Unidos de América Za Spojené státy americké For Amerikas Forenede Stater Für die Vereinigten Staaten von Amerika Ameerika Ühendriikide nimel Για τις Ηνωμένες Πολιτείες της Αμερικής For the United States of America Pour les États-Unis d’Amérique Per gli Stati Uniti d’America Amerikas Savienoto Valstu vārdā Jungtinių Amerikos Valstijų vardu az Amerikai Egyesült Államok részéről Għall-Istati Uniti ta'l-Amerika Voor de Verenigde Staten van Amerika W imieniu Stanów Zjednoczonych Ameryki Pelos Estados Unidos da América Pentru Statele Unite ale Americii Za Spojené štáty americké Za Združene države Amerike Amerikan yhdysvaltojen puolesta För Amerikas förenta stater ANNEX Society for Worldwide Interbank Financial Telecommunication (SWIFT).

Summary: Agreement between the European Union and the United States on the transfer of financial messaging data Agreement between the European Union and the United States on the transfer of financial messaging data SUMMARY OF: EU-US agreement on the processing and transfer of Financial Messaging Data from the EU to the US for the purposes of the Terrorist Finance Tracking Program Decision 2010/412/EU concluding the EU-US agreement on the processing and transfer of Financial Messaging Data from the EU to the US for the purposes of the Terrorist Finance Tracking Program WHAT IS THE AIM OF THE AGREEMENT AND OF THE DECISION? With the aim of preventing, investigating, detecting or prosecuting terrorism or terrorist financing, the agreement between the EU and the US concerns the transfer of: financial payment messages that refer to financial transfers and related data from designated providers* in the EU to the US Treasury Department; relevant information from the US Treasury Department’s Terrorist Finance Tracking Program (TFTP) to EU countries’ law enforcement, public security or counter-terrorism authorities, or to Europol or Eurojust. The decision concludes the agreement on behalf of the EU. KEY POINTS To obtain the necessary data from the EU, the US Treasury Department makes a request, and sends any additional documents, to a designated provider in the US. At the same time, it sends a copy of these documents to Europol, which checks that the request complies with the requirements of the agreement and notifies the designated provider accordingly. Once the compliance of the request is confirmed, it will have binding legal effect and the designated provider is required to transfer the requested data to the US Treasury Department. The US Treasury Department must ensure that certain safeguards, particularly in relation to the protection of personal data, are applied when the data provided are processed. The data may only be processed for the purpose of preventing, investigating, detecting or prosecuting terrorism or terrorist financing. It must be secured from unauthorised access, disclosure and loss, as well as from any unauthorised form of processing. A search of the data provided may only be carried out where there is pre-existing information or evidence indicating that the subject of the search might be connected to terrorism or its financing. All searches and the reasons for them must be recorded. The US Treasury Department must delete non-extracted data: no longer necessary for the fight against terrorism, based on (at least) an annual evaluation;transmitted without having been requested;by 20 July 2012 at the latest, if it was received before 20 July 2007;no later than 5 years after receipt, if it was received after 20 July 2007. Extracted data may be retained for only as long as is necessary to fulfil the purpose for which it was requested. The agreement also defines safeguards to limit the onward transfers of extracted data. The US Treasury Department must make information from the TFTP that may contribute to the EU’s actions against terrorism available to the relevant authorities of the EU countries concerned and, as appropriate, to Europol and Eurojust. Similarly, if any additional information is thought to be necessary to the US’s fight against terrorism, it must be conveyed back. To facilitate these exchanges of information, a Europol liaison officer may be delegated to the US Treasury Department. A relevant EU national authority, Europol or Eurojust may ask US Treasury Department to search data acquired through the TFTP and to transfer relevant information if there is reason to believe that a person or entity is connected to terrorism or its financing as defined by Directive (EU) 2017/541 on combating terrorism and Directive (EU) 2015/849 on the prevention of the use of the financial system for money laundering. During the term of the agreement, the European Commission is to examine the options available for establishing an EU system equivalent to that of the US TFTP. Once a European system is established, there will be the need to review and possibly modify this agreement and ensure the systems are complementary. Independent overseers monitor compliance with the limitations and safeguards of the agreement. They have the authority to review, query and block searches of data provided, as well as to request additional justifications on the connection to terrorism. One of these overseers is appointed by the Commission. Via the national data protection authority, a person has the right to request confirmation that his or her personal data have been processed in compliance with data protection rights under Directive (EU) 2016/680 on protecting personal data when being used by police and criminal justice authorities. Disclosure of this information may be refused or restricted if necessary for the fight against terrorism or the protection of public or national security. In such cases, a written explanation will be given to the person, together with information on the possibility to seek administrative and judicial redress in the US. A person also has the right to request the rectification, erasure or blocking of inaccurate or wrongly processed personal data. To maintain the accuracy of information received or transmitted under this agreement, the data may be supplemented, deleted or corrected by each party. The US Treasury Department provides information on the TFTP on a public website, including on the right of redress. FROM WHEN DO THE AGREEMENT AND DECISION APPLY? The decision has applied since 13 July 2010. The agreement entered into force on 1 August 2010 for a period of 5 years. After that, it is automatically extended for subsequent periods of one year, unless one of the parties notifies of its intention not to extend it. BACKGROUND For more information, see: Terrorist Finance Tracking Programme (European Commission). KEY TERMS Designated providers: providers of international financial payment messaging services. MAIN DOCUMENTS Agreement between the European Union and the United States of America on the processing and transfer of Financial Messaging Data from the European Union to the United States for the purposes of the Terrorist Finance Tracking Program (OJ L 195, 27.7.2010, pp. 5-14) Council Decision 2010/412/EU of 13 July 2010 on the conclusion of the Agreement between the European Union and the United States of America on the processing and transfer of Financial Messaging Data from the European Union to the United States for the purposes of the Terrorist Finance Tracking Program (OJ L 195, 27.7.2010, pp. 3-4) Successive amendments to Decision 2010/412/EU have been incorporated in the original document. This consolidated version is of documentary value only. RELATED DOCUMENTS Directive (EU) 2017/541 of the European Parliament and of the Council of 15 March 2017 on combating terrorism and replacing Council Framework Decision 2002/475/JHA and amending Council Decision 2005/671/JHA (OJ L 88, 31.3.2017, pp. 6-21) Commission staff working document Joint Review Report of the implementation of the Agreement between the European Union and the United States of America on the processing and transfer of Financial Messaging Data from the European Union to the United States for the purposes of the Terrorist Finance Tracking Program — Accompanying the document — Report from the Commission to the European Parliament and the Council — On the joint review of the implementation of the Agreement between the European Union and the United States of America on the processing and transfer of Financial Messaging Data from the European Union to the United States for the purposes of the Terrorist Finance Tracking Program (SWD(2017) 17 final) Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (OJ L 119, 4.5.2016, pp. 89-131) See consolidated version. Information concerning the date of entry into force of the Agreement between the European Union and the United States of America on the processing and transfer of Financial Messaging Data from the European Union to the United States for purposes of the Terrorist Finance Tracking Program (OJ L 195, 27.7.2010, p. 15) last update 21.01.2019