The European Data Protection Supervisor has issued his opinion on the role of the European Central Bank in the SWIFT case. There is a bit of a history behind this: the SWIFT case started in June 2006 when press coverage revealed a secret US terrorist financing tracking system. This raised issues of compliance with European data protection legislation, and complaints were lodged with data protection authorities all over Europe.Have a look at this here, for some background.
The Opinion ought to be available here, but isn’t yet. Keep looking. ECB’s position in the context of the payment system is threefold, being an overseer, a user, and a policy maker. When deciding to use SWIFT’s services in its own payment operations, the ECB was placed in the position of a joint controller. As such, it is co-responsible for ensuring full compliance with data protection rules. This includes ensuring respect for the purpose limitation principle, information to data subjects, and adequate guarantees when personal data are transferred to third countries.