Application for access to and/or rectification, erasure or blocking of

Application for access to and/or rectification, erasure or blocking of personal data held

pursuant to the U.S. Terrorist Finance Tracking Program (TFTP)

WP29 - Uniform Procedure for Access Requests

Please find attached the final proposal for the uniform procedure for access requests, pursuant to

the EU-U.S. TFTP Agreement. Attached, you will find the draft procedure, as well as templates for:

Identification Verification Form (Form A)

Article 15 Access Request Form (Form B)

Article 16 Rectification, Erasure or Blocking Request Form (Form C)

Waiver Form (Form D)

Standard letter from National Data Protection Authority (DPA) to the U.S. Department of the

Treasury (U.S. Treasury Department) (Form E)

Annex 1 - List of national DPAs

Annex 2 - List of authorised national means of identification

Ref. Ares(2013)2097175 - 13/06/2013

Application for access to and/or rectification, erasure or blocking of personal data held

pursuant to the U.S. Terrorist Finance Tracking Program (TFTP)

Procedure for data protection authorities

1. The attached information leaflet, forms and annexes are to be placed on the website of the

national DPA (in English), together with an explanation in the national language(s).

2. Upon receip of a request for access, rectification, erasure, or blocking of personal data as well

as a waiver form, the national DPA will first verify the identity of the requester. This will be done

through matching of the information filled out on the forms and the copy of the means of

identification. Furthermore, the characteristics of the identity card shall be verified through the

European Unions Public Register of Authentic Identity and Travel Documents Online (PRADO),

available on http://prado.consilium.europa.eu/en/homeIndex.html. Instead of providing the DPA

with a copy of a means of identification, the requester should also be able to prove his identity in

person at the office of the DPA, presenting the original means of identification.

3. When the national DPA confirms the requester is who he says he is through completion of the

identification confirmation form (Form A), the national DPA will forward the original access

request form (Form B) and/or the rectification, erasure, or blocking request form (Form C) and

the waiver form (Form D) (all completed in English), together with a signed copy of the attached

standard letter (Form E), to the U.S. Treasury Department via regular (postal) mail or express

courrier at the following address:

U.S. Treasury Department

Director, Office of Privacy and Civil Liberties

1500 Pennsylvania Avenue, NW

ATTN: 1750 Pennsylvania Avenue, NW, Room 8125

Washington, DC 20220

The national DPA will include in the standard letter (Form E) a unique case number issued by

the national DPA in the following format:

[EU Country Code] – [regular national case number] (for example DE-12345)

The national DPA and the U.S. Treasury Department will include this unique case number on all

correspondence related to the request. Copies of all forms submitted in connection with a

request are held in the file of the national DPA.

4. At the same time that the national DPA forwards the request to the U.S. Treasury Department,

the national DPA will send an e-mail to the U.S. Treasury Department at the following address:

[email protected]. In this e-mail, the national DPA will notify the U.S. Treasury Department

that the national DPA has sent a request or requests via regular mail and inform the U.S.

Treasury Department of the unique case number the DPA has assigned to the request(s) sent

via regular mail.

Upon its receipt of the request via regular mail (not the e-mail notice), the U.S. Treasury

Department will respond via regular mail to the national DPA from which the U.S. Treasury

Department received the request, acknowledging receipt, providing the unique case number the

U.S. Treasury Department has assigned to the request, and including the unique case number

the national DPA assigned to the request. The unique case number provided by the EU will be

any case number the national DPA chooses to assign to the request preceded by the two-digit

country code of the EU member state from which the request is sent.

5. The EU shall maintain a current list of its member states’ national DPAs and provide the

link/URL containing that list to the U.S. Treasury Department. If the U.S. Treasury Department

receives a request sent by anyone who is not identified on the current list of national DPAs as

the national DPA for the country from which the request is sent, the U.S. Treasury Department’s

only response will be via e-mail to notify the sender that they are not on that list and, therefore,

the request cannot be processed until the current list of national DPAs is updated.

6. After the U.S. Treasury Department completes its review of the request, it will notify the national

DPA about the outcome of the review via regular mail, and concurrently send an e-mail stating

only that the response has been sent via regular mail and referencing both the U.S. Treasury

Department’s unique case number and that assigned by the national DPA. The national DPA

will forward this information without undue delay to the requester. Should no follow up be

required to the initial request, the national DPA may decide to close the file of the requester in

line with its own proceedings. No later than six months after the file is closed, the national DPA

will ensure the requester-provided copy of the means of identification is destroyed. All other

information related to the file shall be processed according to the national data protection act

and in line with national archive obligations.

http://ec.europa.eu/justice/data-protection/bodies/authorities/eu/index_en.htm

Application for access to and/or rectification, erasure or blocking of personal data held

pursuant to the U.S. Terrorist Finance Tracking Program (TFTP)

Information

Article 15 of the Agreement between the United States of America and the European Union on the

Processing and Transfer of Financial Messaging Data from the European Union to the United

States for the Purposes of the Terrorist Finance Tracking Program (hereafter: the TFTP

Agreement) provides the ability to seek access to personal data processed under the Agreement.

Article 16 provides the ability to seek rectification, erasure or blocking of personal data that are

inaccurate or processed in contravention of the Agreement. Articles 15 and 16 provide that your

national data protection authority will act as intermediary to the U.S. Treasury Department, which

administers the TFTP.

If you wish to make a request pursuant to Article 15 and/or Article 16 of the TFTP Agreement,

please fill out the attached identification form (Form A), as well as the request form(s) (Form(s) B

and/or C) and waiver form (Form D). This is the information that is needed by the U.S. Treasury

Department to conduct a thorough and accurate review in response to your request.

Proof of identity

Your national data protection authority needs to be satisfied that you are who you say you are.

Consequently, we require you to provide evidence of your identity by supplying a photocopy of a

driving licence, passport, identity card or other official identity document containing your

photograph and bearing your signature. Please see Annex 2 for an overview of the official means

of identification in your country.

Your national data protection authority will verify your identity based solely on the information you

provide. The photocopy of your proof of identity will not be transferred to the U.S. Treasury

Department, but will remain with your national data protection authority. No later than six months

after the file related to your Article 15 and/or Article 16 request has been closed, this photocopy will

be destroyed.

Please note that this procedure only applies to individuals with the nationality of one of the EU

Member States and those permanently residing in one of the countries of the European Union.

Procedure

In order to start your application for access, please ensure you send at least the following

information in hard copy to your data protection authority (see Annex 1):

Identification Verification Form (Form A) - fully completed and signed

Article 15 Access Request Form (Form B) -

fully completed and signed and/or

Article 16 Rectification, Erasure or Blocking Request Form (Form C) -

fully completed and signed

Waiver form (Form D) - fully completed and signed

Photocopy of an official means of identification bearing your signature

(see Annex 2)

Further information regarding your request may be provided in a separate letter. Please ensure

that you have clearly indicated whether you authorize the transfer of the additional information to

the U.S. Treasury Department. Without explicit authorization to transfer the additional information

to the U.S. Treasury Department, that information will only be retained by your national data

protection authority and will not be used by the U.S. Treasury Department to help process the

request.

Should there be a reason why you are not able or willing to provide a copy of your means of identification to

your national DPA, you can make an appointment to present this document in person. The necessary

verifications of your identity will then be made in person at the office of your national DPA.

Upon its receipt of your application, your national DPA will forward Form D and Form(s) B and/or C

to the U.S. Treasury Department. Your national DPA will keep you informed about the procedure

and after a response is provided to your national DPA by the U.S. Treasury Department, your

national DPA will forward the information regarding your request to you without undue delay.

However, please bear in mind that the response to your access request may be very limited, given

the nature of the Terrorist Finance Tracking Program.

Further information

For further information about the TFTP Agreement and requests pursuant to Article 15 and/or

Article 16, please see www.treasury.gov/tftp.

Application for access to and/or rectification, erasure or blocking of personal data held

pursuant to the U.S. Terrorist Finance Tracking Program (TFTP)

Form A. Identification Verification

1. Surname / Family name:

2. First Name(s):

3. Maiden / Other names:

4. Place of Birth:

5. Date of Birth:

6. Residential Address:

7. Telephone number*:

8. E-mail address*:

9. Type of identification document provided (please tick)

 Passport

 Driver licence

 Identity card

 Other official document (Please specify):_______________

 Tick here to confirm that the document bears the photograph and signature of the person

presenting it.

Signature of the Requester Date

Signature of the National DPA Date

* Not mandatory; this information will only be used to contact you for further information regarding your request.

Application for access to and/or rectification, erasure or blocking of personal data held

pursuant to the U.S. Terrorist Finance Tracking Program (TFTP)

Form B. Article 15 Access Request

1. Surname / Family name:

2. First Name(s):

3. Maiden / Other names:

4. Residential Address:

5. Bank Name(s):

6. Bank Address(es):

7. Account Number(s):

8. If applicable, describe the records being requested

Signature of the Requester Date

Signature of the National Data Protection Date

Authority

Further information may be provided in a separate letter. If a separate letter is provided, please state explicitly if you

authorize to transfer the information in that letter to the U.S. Treasury Department

Application for access to and/or rectification, erasure or blocking of personal data held

pursuant to the U.S. Terrorist Finance Tracking Program (TFTP)

Form C. Article 16 Rectification, Erasure or Blocking Request

1. Surname / Family name:

2. First Name(s):

3. Maiden / Other names:

4. Residential Address:

5. Bank Name(s):

6. Bank Address(es):

7. Account Number(s):

8. Please provide: (a) a precise identification of the record that you believe to be inaccurate or to

have been processed in contravention of the TFTP Agreement, including a description of the

record, the date and any other identifying details; (b) the specific material to be amended, deleted,

or blocked, if any, including a citation of the specific paragraph, sentence, and word to be

amended, deleted, or blocked; (c) a statement regarding why the information is not accurate or

complete, including supporting evidence; and (d) the specific material to be added, if any, and the

exact place at which it is to be added, including evidence of the validity of new or additional

information. If you wish to correct or add any information, you must provide specific proposed

language for the desired correction or addition. Finally, indicate whether you have contacted your

financial institution seeking rectification, deletion, or blocking of any information you believe to be

inaccurate and, if so, how the financial institution responded.

Signature of the Requester Date

Signature of the National DPA Date

Further information may be provided in a separate letter. If a separate letter is provided, please state explicitly if you

authorize to transfer the information in that letter to the U.S. Treasury Department

Application for access to and/or rectification, erasure or blocking of personal data held

pursuant to the U.S. Terrorist Finance Tracking Program (TFTP)

Form D. Waiver

(please fill out your full name in the box above)

hereby authorize

(please fill out the name of your national data protection authority in the box above [see Annex 1])

to make a request on my behalf to the U.S. Treasury Department pursuant to Article 15 and/or

Article 16 of the Agreement between the United States of America and the European Union on the

Processing and Transfer of Financial Messaging Data from the European Union to the United

States for the Purposes of the Terrorist Finance Tracking Program; authorize the national Data

Protection Authority identified above to disclose personal data submitted in connection with this

request to the U.S. Treasury Department; and consent to the U.S. Treasury Department disclosing

my personal data to the national Data Protection Authority identified above in connection with any

response to the request.

Signature of the Requester Date

Signature of the National DPA Date

Application for access to and/or rectification, erasure or blocking of personal data held

pursuant to the U.S. Terrorist Finance Tracking Program (TFTP)

Form E. Standard letter

U.S. Treasury Department

Director, Office of Privacy and Civil Liberties

1500 Pennsylvania Avenue, NW

ATTN: 1750 Pennsylvania Avenue, NW, Room 8125

Washington, DC 20220

Regarding Our Case Number [ISO Country Code]-[National Case Number]

Dear Sir, Madam,

In accordance with Articles 15 and 16 of the EU-U.S. Agreement on the Processing and Transfer

of Financial Messaging Data from the European Union to the United States for the Purposes of the

Terrorist Finance Tracking Program (hereafter: the TFTP Agreement), I hereby transfer to you an

application for access to and/or rectification, erasure, or blocking of personal data from [Name

Requester or minor/individual with legal guardian].

Following the procedure suitable to the U.S. Treasury Department, I hereby confirm that I have

received the proof of identity of the requester. [Name Requester] [provided a copy of] OR

[presented] his/her [Type of Official Document] to our data protection authority. I furthermore

confirm that I have verified and confirmed the identity of the requester. IF NEEDED: The requester

is the [parent of the named minor / legal guardian of the named individual] and has provided

adequate proof of that legal position. In addition to verifying the identity of the requester, I hereby

confirm that I have verified the legal relationship between the requester and the [named

minor/named individual].

Please find attached the original request as contained in the [Article 15 Access Request Form]

AND/OR [Article 16 Rectification, Erasure, or Blocking Request Form], as well as the Waiver

Form, allowing for any information resulting from your review to be transferred to [Name National

DPA] for onward transfer to [Name Requester].

I confirm that an email notification of this request, which includes the unique case number provided

above, has been sent to the following address: [email protected].

I request that you will ensure an appropriate review in connection with the request is made without

undue delay. The [Name National DPA] would appreciate to be informed at the latest one month

after today of the outcome of the review.

For more information related to this request, please contact:

[Contact details].

Sincerely yours,

[Signed]

Application for access to and/or rectification, erasure or blocking of personal data held

pursuant to the U.S. Terrorist Finance Tracking Program (TFTP)

Annex 1 - List of national data protection authorities

Austria

Österreichische Datenschutzkommission

Hohenstaufengasse 3

1010 Wien

Belgium

Commission de la protection de la vie privée

Rue de la Presse / Drukpersstraat 35

B - 1000 Brussels

Bulgaria

Комисията за защита на личните данни

Commission for Personal Data Protection

15 Acad. Ivan Evstratiev Geshov Blvd.

Sofia 1431

Cyprus

Γραφείου Επιτρόπου Προστασίας Δεδομένων Προσωπικού Χαρακτήρα

Commissioner for Personal Data Protection

1 Iasonos street,

CY - 1082 Nicosia

P.O. Box 23378, CY-1682 Nicosia

Czech Republic

Urad pro ochranu osobnich udaju

The Office for Personal Data Protection

Pplk. Sochora 27

CZ - 170 00 Prague 7

Denmark

Datatilsynet

Borgergade 28, 5

DK - 1300 Copenhagen K

Estonia

Andmekaitse Inspektsioon

Estonian Data Protection Inspectorate

Väike-Ameerika 19

10129 Tallinn

Finland

Tietosuojavaltuutetun toimisto

Office of the Data Protection Ombudsman

P.O. Box 315

FIN-00181 Helsinki

France

Commission Nationale de l'Informatique et des Libertés

8, rue Vivienne, CS 30223

F-75002 Paris, CEDEX 02

Germany

Der Bundesbeauftragte für den Datenschutz und die Informationsfreiheit

Husarenstraße 30

53117 Bonn

Greece

Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα

Hellenic Data Protection Authority

Kifisias Av. 1-3, PC 11523

Ampelokipi Athens, Greece

Hungary

Nemzeti Adatvédelmi és Információszabadság Hatóság

Hungarian National Authority for Data Protection and Freedom of Information

Szilágyi Erzsébet fasor 22/C

H - 1125 Budapest

Ireland

Data Protection Commissioner

Canal House

Station Road - Portarlington, Co. Laois

Ireland

Italy

Garante per la protezione dei dati personali

Piazza di Monte Citorio, 121

I - 00186 Roma

Latvia

Datu valsts inspekcija

Data State Inspectorate

Blaumana str. 11/13-15

LV - 1011 Riga

Lithuania

Valstybinė duomenų apsaugos inspekcija

State Data Protection Inspectorate

Juozapavičiaus str. 6 / Slucko str. 2

LT - 09310 Vilnius

Luxembourg

Commission nationale pour la protection des données

41, avenue de la Gare

L-1611 Luxembourg

Malta

Office of the Information and Data Protection Commissioner

Data Protection Commissioner

2, Airways House

High Street, Sliema SLM 1549, Malta

The Netherlands

College bescherming persoonsgegevens (CBP)

Dutch Data Protection Authority

Afdeling Internationaal

Juliana van Stolberglaan 4-10

P.O.Box 93374

NL - 2509 AJ Den Haag/The Hague

Poland

Generalny Inspektor Ochrony Danych Osobowych

The Bureau of the Inspector General for the Protection of Personal Data

ul. Stawki 2

00-193 Warsaw

Portugal

Comissão Nacional de Protecção de Dados

R. de São. Bento, 148-3°

P - 1200-821 LISBOA

Romania

Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal

The National Supervisory Authority for Personal Data Processing

Str. Olari nr. 32

Sector 2, BUCUREŞTI

Cod poştal 024057

Romania

Slovakia

Office for Personal Data Protection of the SR

Úrad na ochranu osobných údajov Slovenskej republiky

Odborárske námestie č. 3

817 60, Bratislava

Slovak Republic

Slovenia

Informacijski Pooblaščenec

Information Commissioner

Zaloska 59SI - 1000 LJUBLJANA

Spain

Agencia Española de Protección de Datos

C/Jorge Juan, 6

E - 28001 MADRID

Sweden

Datainspektionen

Drottninggatan 29, 5th Floor

Box 8114

S - 104 20 STOCKHOLM

United Kingdom

Information Commissioner’s Office

Water Lane, Wycliffe House

UK - WILMSLOW - CHESHIRE SK9 5AF

Application for access to and/or rectification, erasure or blocking of personal data held

pursuant to the U.S. Terrorist Finance Tracking Program (TFTP)

Annex 2 - List of authorised national means of identification

Country

Means of identification

Austria

Passport / Driving Licence / National Identity Card

Belgium

Passport / Driving Licence / National Identity Card

Bulgaria

Identity Documents / Driving Licence / Residence Documents

Cyprus

Passport / National Identity Card / Alien Registration Certificate

Czech Republic

Passport / National Identity Card / Residence Card

Denmark

Passport / Driving Licence / National Identity Card

Estonia

Passport / Driving Licence / National Identity Card

Finland

Passport / National Identity Card

France

Passport / Driving Licence / National Identity Card

Germany

Passport / Driving Licence / National Identity Card

Greece

Passport / Driving Licence / National Identity Card

Hungary

Passport / Driving Licence / National Identity Card

Ireland

Passport / Driving Licence / National Identity Card

Italy

Passport / Driving Licence / National Identity Card

Latvia

Passport / Driving Licence / National Identity Card

Lithuania

Passport / Driving Licence / National Identity Card

Luxembourg

Passport / Driving Licence / National Identity Card

Malta

Passport / Driving Licence / National Identity Card

Netherlands

Passport / Driving Licence / National Identity Card

Poland

Passport / Driving Licence / National Identity Card

Portugal

Passport / National Identity Card

Romania

Passport / Driving Licence / National Identity Card

Slovakia

Passport / Driving Licence / National Identity Card / Border Pass

Slovenia

Passport / Driving Licence / National Identity Card

Spain

Passport / Driving Licence / National Identity Card

Sweden

Swedish or EU Passport / Swedish Driving Licence / Swedish National Identity

Card / Swedish SIS-marked ID Card

United Kingdom

Passport / Driving Licence / Identity Card for Foreign Nationals or Biometric

Residence Permit