SWIFT broke EU data laws, panel says

"SWIFT and financial institutions must immediately take the necessary measures to end this illegality," the letter adds.

The European Commission is keeping its options open for now with a commission spokesman telling Spain's El Pais on Wednesday the report "is not binding, although it is an important political opinion, that we cannot ignore."

The commission could take legal action against the Belgian government for failing to ensure SWIFT complies with EU regulations, but the SWIFT company itself - situated just outside EU capital Brussels - is unlikely to face sanctions.

Belgian prime minister Guy Verhofstadt has previously said his country is not to blame and called on the EU to negotiate a formal data-sharing agreement with the US to provide legal clarity for firms such as SWIFT for the future.

SWIFT, which stands for the Society for Worldwide Inter-bank Financial Telecommunications, handles about 11 million financial transactions per day in more than 200 countries worldwide.

Its standard transfer format contains the names of the donor and receiver, the account number and bank address, as well as the amount and the intended purpose of the transfer.

It became known in June this year that officials from the CIA, the FBI and other US agencies had since 2001 been allowed to inspect the transfers as part of the global fight against terrorism.

But under EU law, it is illegal for companies to transfer confidential personal data to another country unless that country offers adequate protection.

SWIFT has defended its actions by saying that it was obliged to cooperate with Washington under US law since some of its branches are located in the US.

But this argument was rejected in September by a Belgian investigation which said SWIFT was subject to Belgian rules, regardless of whether the data transferred to US authorities came only from the company's US subsidiary or from its headquarters in Belgium.

European Central Bank President Jean-Claude Trichet told the European Parliament last month that power to prevent the transfer of personal data to US authorities for use in anti-terror investigations by SWIFT were "beyond the remit" of his bank or of European national banks.