European data protection supervisor adds voice to criticism of Privacy Shield

'Not robust enough to withstand future legal scrutiny' says Buttareli

The European data protection supervisor (EDPS) Giovanni Buttarelli has raised concerns about the EU-US Privacy Shield data-sharing pact, claiming that it is not robust enough to stand up to proper legal scrutiny.

This supports a resolution by the European Parliament last week in which MEPs voted 501 to 119 that the draft agreement should be renegotiated. Privacy Shield does not meet the criteria of "necessity" and "proportionality" laid down in the EU Charter of Fundamental Rights, the MEPs said. However, neither this decision nor that of the EDPS is legally binding.

Privacy Shield is a data transfer mechanism that is intended to replace Safe Harbour, which was ruled illegal last October because the privacy of European citizens' data could not be guaranteed.

Buttarelli has now said that Privacy Shield suffers from similar weaknesses and if unchanged will likely face the same fate as Safe Harbour.

"I appreciate the efforts made to develop a solution to replace Safe Harbour, but Privacy Shield as it stands is not robust enough to withstand future legal scrutiny," Buttarelli said.

"Significant improvements are needed should the European Commission wish to adopt an adequacy decision, to respect the essence of key data protection principles with particular regard to necessity, proportionality and redress mechanisms."

Privacy Shield was broadly welcomed by technology companies when it was announced, with Microsoft calling it "a step in the right direction," while admitting that further work would be needed to make the framework fully compatible with international law.

"We continue to believe today that additional steps will be needed to build on the Privacy Shield after it is adopted, ranging from additional domestic legislation to modernisation of mutual legal assistance treaties and new bilateral and ultimately multilateral agreements," Microsoft said in April.

"But we believe that the Privacy Shield as negotiated provides a strong foundation on which to build."