The European Commission has published details of its transatlantic "Privacy Shield" agreement, which is designed to ensure that personal information of citizens is protected to EU standards when it is sent to the US—even though it would appear that the NSA will continue to carry out bulk collection of data under the new pact.

The new deal replaces the earlier Safe Harbour framework, which was struck down by the Court of Justice of the European Union (CJEU) following a complaint by privacy activist Max Schrems.

An accompanying Privacy Shield FAQ released by Brussels' officials explained that there are four main elements. According to the commission, the new agreement will "contain effective supervision mechanisms to ensure that companies respect their obligations, including sanctions or exclusion if they do not comply."

The commission added that "for the first time, the US government has given the EU written assurance from the Office of the Director of National Intelligence that any access of public authorities for national security purposes will be subject to clear limitations, safeguards and oversight mechanisms." That pledge is an attempt to address the key concern raised by the CJEU—the NSA's bulk collection of EU citizens' personal data.

According to a letter from Robert Litt, General Counsel of the Office of the Director of National Intelligence, there are six situations in which the NSA will be explicitly allowed to use data collected in bulk, including for undefined "counter-terrorism" purposes.

However, as Schrems pointed out, in its judgment the CJEU wrote: "Legislation permitting the public authorities to have access on a generalised basis to the content of electronic communications must be regarded as compromising the essence of the fundamental right to respect for private life, as guaranteed by Article 7 of the Charter." It would appear, though, that the NSA's "assurance" still allows "access on a generalised basis," potentially putting the entire Privacy Shield agreement at risk if and when a legal challenge is brought to the EU's highest court.

In his reaction to the new agreement, Schrems wrote: "Basically, the US openly confirms that it violates EU fundamental rights in at least six cases. The commission claims that there is no 'bulk surveillance' any more, when its own documents say the exact opposite."

The Privacy Shield agreement creates a new "Ombudsperson" to deal with complaints from Europeans about how their data has been used by the NSA. The Ombudsperson mechanism will be within the Department of State, and "independent from national security services," the EC said. According to Reuters, US under secretary of state Catherine Novelli—an erstwhile top Apple policy exec—will take on this role.

Earlier this month, the key EU Article 29 Working Party, which represents national data protection authorities in the 28-member-state bloc, laid down its four requirements for a Safe Harbour replacement. One of which stated: "An independent oversight mechanism should exist, that is both effective and impartial: this can either be a judge or another independent body, as long as it has sufficient ability to carry out the necessary checks." The Article 29 Working Party may not be happy with a senior US state department official taking on this role instead. The European Ombudsman has similarly expressed scepticism about this approach.

European citizens, in addition to the Ombudsperson, will have several other ways to obtain redress if they believe that their personal data has been misused in the US. The Privacy Shield FAQ explained: "Complaints have to be resolved by companies within 45 days. A free of charge alternative dispute resolution [ADR] solution will be available. EU citizens can also go to their national data protection authorities, who will work with the US department of commerce, and Federal Trade Commission to ensure that unresolved complaints by EU citizens are investigated and resolved." There will also be an annual joint review mechanism.

Here's how the Privacy Shield will apparently work in practice, according to the FAQ blurb: "American companies will register to be on the Privacy Shield List and self-certify that they meet the requirements set out. This procedure has to be done each year. The US department of commerce will have to monitor and actively verify that companies' privacy policies are presented in line with the relevant Privacy Shield principles and are readily available."

In addition, last week President Obama signed the US Judicial Redress Act. The Privacy Shield FAQ noted that this will "give EU citizens access to US courts to enforce privacy rights in relation to personal data transferred to the US for law enforcement purposes. The Judicial Redress Act will extend the rights US citizens and residents enjoy under the 1974 Privacy Act also to EU citizens."

The Privacy Shield will not come into force until the European Commission has adopted an "adequacy finding"—essentially a declaration that the safeguards provided when data are transferred under the new Privacy Shield scheme are equivalent to data protection standards in the EU.

However, that adequacy finding will not be adopted until after the Article 29 Working Party has given its opinion on the new framework, and it is not at all clear that it will regard it as offering sufficient protection for EU personal data.

Shortly before publishing details about the Privacy Shield deal with the US, EU justice commissioner Věra Jourová tweeted: "The new #PrivacyShield will bring robust #EUDataP for Europeans' data in the US. Trust is key for transatlantic data transfer."

However, with what seems like extraordinarily bad timing, President Obama has just made winning the trust of EU citizens even harder. As Ars reported last week, the Obama administration is close to allowing the NSA to share more of the private communications it intercepts with other federal agencies, including the FBI and the CIA, without removing identifying information first.

In other words, not only will the new Privacy Shield allow the NSA to continue to scoop up huge quantities of personal data from EU citizens, it may soon be allowed to share them widely. That's unlikely to go down well with Europeans, the Article 29 Working Party, or the CJEU—all of which ironically increases the likelihood that the new Privacy Shield will suffer the same fate as the Safe Harbour scheme it has been designed to replace.