A group of leading digital rights organisations on both sides of the Atlantic has called for the Privacy Shield arrangement between the EU and US to be sent back to the negotiators. In a letter to senior EU officials, the group says that without "substantial reforms" to ensure protection for fundamental rights of individuals, the Privacy Shield will "put users at risk, undermine trust in the digital economy, and perpetuate the human rights violations that are already occurring as a result of surveillance programs and other activities."

Specifically, the organisations say that the EU's acceptance of the Privacy Shield should be contingent on the US reforming its surveillance laws. "These reforms must include, at a minimum, the incorporation of human rights standards (applying to both US persons and non-US persons), a narrowed definition of 'foreign intelligence information' to limit the scope of data collection, and more limited access to, retention of, and use of data after it is collected. Indiscriminate scanning of communications content and metadata, specifically, must be discontinued."

It's not just the US that must rein in its spying. Tucked away in a footnote to the letter is the sentence: "To prevent a double standard, the Commission must seek a similar pledge from EU Member States to commit to reforming their surveillance authorities." That's clearly directed at the UK, following Snowden's revelations of the massive scale of GCHQ's snooping around the world, something the current Investigatory Powers Bill will do nothing to change.

Getting the US to modify its surveillance laws may be a rather ambitious goal, but if it doesn't, there is a risk that the Privacy Shield will be rejected by the Article 29 Working Party, which is made up of national data protection officials from around the EU.

In the wake of the Court of Justice of the European Union (CJEU) striking down the Safe Harbour framework, the Article 29 Working Party outlined four conditions for the proposed Privacy Shield to meet the standards of EU legislation and protect human rights during the gathering of intelligence. According to the privacy groups' letter, "the Privacy Shield manifestly fails to provide for these objectives."

In addition to curbing state snooping, the transatlantic group also wants more protection from privacy abuse by companies: "a lasting data transfer framework requires increased protections for personal data collected or used commercially in order to meet the standards set forth by the CJEU. Wider data protection reforms, which must include robust and comprehensive enforcement mechanisms, are necessary to ensure that the US provides a level of essentially equivalent protection to that available under the European legal framework." US companies have been lobbying fiercely against any such restrictions on how they can use the personal data of EU citizens.

Later today, the Civil Liberties, Justice and Home Affairs committee of the European Parliament will be holding a debate on the Privacy Shield proposals. As the draft programme shows, one of the speakers will be Max Schrems, whose case at the CJEU is the reason why a replacement for Safe Harbour is now so urgently required. The session will be livestreamed, starting at 3pm CET today.