A/HRC/13/37 Worldwide Interbank Financial Telecommunication (SWIFT), the Belgian cooperative responsible for enabling messaging between more than 7,800 financial institutions in over 200 countries. By gaining access to the SWIFT data centre in the United States, the country’s Treasury was then able to monitor foreign financial transactions across the SWIFT network, to find and identify terrorist suspects.68 Human rights groups filed legal complaints in over 20 courts arguing that, by handing this information over to United States authorities, SWIFT was in breach of local privacy laws.69 46. The Special Rapporteur is also concerned that surveillance is being embedded in technological infrastructures, and that these will create risks for individuals and organizations. For example, the development of standards for lawful interception of communications requires telecommunications companies to design vulnerabilities into their technologies to ensure that States may intercept communications. These capabilities were abused in Greece where unknown third parties were able to listen to the communications of the Prime Minister of Greece, and dozens of other high-ranking dignitaries.70 More recently, these same capabilities were reported to have been used by the Government of the Islamic Republic of Iran to monitor protestors.71 To avoid abuse, surveillance technologies should log who accesses data, thereby leaving a trail that can itself be monitored for abuse.72 47. In some States, constitutional safeguards continue to apply, however. In Canada, for example, the Charter of Rights and Freedoms protects privacy of information held by third parties when it reveals “intimate details of the lifestyle and personal choices of the individual”.73 This requires balancing of the societal interests in protecting individual dignity, integrity and autonomy with effective law enforcement.74 The jurisprudence of the European Convention of Human Rights has similarly extended the right to privacy to information held by third parties. The Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data requires both the public and private sectors to protect the information that they hold and regulates the sharing of information with government agencies. Exceptions apply when protecting State security, public safety or the monetary interests of the State, suppressing criminal offences or protecting individuals or the rights and freedoms of others.75 D. Best practices 48. The Special Rapporteur is concerned that there is a trend towards extending such State surveillance powers beyond terrorism. Following the events of 11 September 2001, a number of legislatures introduced sunset clauses into and reviews of anti-terrorism legislation, as it was assumed that extraordinary powers may be required for a short period of time to respond to the then danger. These sunset clauses and reviews were not included 68 69 70 71 72 73 74 75 GE.09-17804 See also the statement of United States Under Secretary Stuart Levey on the Terrorist Finance Tracking Program, 23 June 2006. See, for example, Privacy International, “Pulling a Swift one? Bank transfer information sent to U.S. authorities”, 27 July 2006. See, for background, V. Prevelakis and D. Spinellis, “The Athens Affair”, IEEE Spectrum, July 2007. See, for reference, Nokia Siemens Networks, “Provision of lawful intercept capability in Iran”, 22 June 2009. See footnote 54. See Supreme Court of Canada, R. v. Plant, 1993, and R. v. Tessling, 2004. R. v. Plant. Article 9 of the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data. 17