Parliament refused on Thursday to give its consent to the EU's interim agreement on banking data transfers to the USA via the SWIFT network, amid concerns for privacy, proportionality and reciprocity.

This move renders the text signed between the US and the 27 EU Member states legally void. MEPs propose to negotiate a new agreement.

The resolution rejecting the agreement was approved by 378 votes to 196, with 31 abstentions. It also asks the Commission and the Council to initiate work on a long-term agreement with the USA on this issue. MEPs reiterate that any new agreement must comply with Lisbon Treaty requirements, and in particular the Charter of Fundamental Rights.

A proposal by the EPP and ECR groups to postpone the vote was rejected by 290 votes to 305, with 14 abstentions.

"Council has not been tough enough on data protection" said rapporteur Jeanine Hennis-Plasschaert (ALDE, NL), who argued that the rules on data transfer and storage provided for in the interim agreement were not proportionate to the security supposedly provided.

In order to continue sharing financial data in the purpose of fighting terrorism, the EU and the United States still rely on a Mutual Legal Assistance agreement allowing for exchange of data within the framework of EU member states national law.

The European Commission announced yesterday, in a letter to EP president Jerzy Buzek, that it is to adopt draft negotiation guidelines for a long term agreement "in the coming weeks". The guidelines "will address the European Parliament and Council's concerns" and ensure "the utmost respect for privacy and data protection".

MEPs reaffirmed the principles set out earlier in a resolution approved on 17 September 2009.

Data on EU citizens to be subject to EU rules

In the September 2009 resolution, MEPs demanded that the accord should fully respect the rights of EU citizens with regard to personal data protection. The data, they said, should be gathered "only for the purposes of fighting terrorism" and "the right balance" must be struck between security measures and the protection of civil liberties.

The resolution calls for "the same judicial redress mechanisms as would apply to data held within the EU, including compensation in the event of unlawful processing of personal data".

In July 2009, the press revealed that a new agreement was to be negotiated following changes in the structure of SWIFT. The company had set up a storage centre for its European data in Switzerland, which meant that intra-European data was stored only in Europe. Until then the data had also been kept on a server in the United States.

This new architecture required the negotiation of a fresh agreement between the Commission and Council on the one hand and the United States on the other.