The Article 29 Working Party (a cross EU panel of privacy watchdog representatives) voiced concerns. Now the European Data Protection Supervisor has said that in his view the proposed Privacy Shield is not robust enough to withstand future scrutiny. So what next for the hastily negotiated replacement to Safe Harbor?
The views of the EDPS, Mr Buttarelli, don't mean that the shield proposals are dead in the water, but they will strengthen calls for further refinement before any measures are introduced.
I wrote towards the end of last week about concerns that are now being raised around the potential vulnerability of the EU Model Clauses (another method used to help legitimise legally EU-US data transfers) to indiscriminate surveillance. Industries are therefore desperate for some clarity in this area and a solution that that stands the test of time (and the courts).
The situation is complicated further by the new General Data Protection Regulation due to come into force within the next 2 years in Europe. This will tighten data protection further this side of the Atlantic and there are concerns as to how well the Privacy Shield proposals reflect these changes.
It doesn't look like the shield is there yet. Well it isn't. But that doesn't mean we're back to the drawing board. What is clear though is that there is still a lot of work to be done to resolve key concerns before the waters are calm again.
....the EDPS said the Privacy Shield agreement needed to provide "adequate protection against indiscriminate surveillance" and "obligations on oversight, transparency, redress and data protection rights".