BRUSSELS—National representatives considering whether or not to approve the proposed Privacy Shield on EU-US data transfers are still waiting to see new text from the European Commission, Ars has learned.

“We had understood, thanks to hints from the commission, that we would get a new draft of the shield on Monday, and could go away consider it for a couple of weeks then come back and vote on June 20. But that didn’t happen. While progress has been made, we are certainly not at the endgame,” a source from the Article 31 committee—made up EU member states and tasked with making decisions on the Data Protection Directive—told Ars.

“The commission did brief us on developments from the negotiations and said there had been breakthroughs in a few areas with regard to the ombudsman," the source explained in reference to the latest committee meeting, which took place on Monday.

"They were very keen to stress that there was more clarification in the language regarding the independent and autonomous nature of the ombudsman, its role, and functions.”

The Privacy Shield has been proposed to replace the Safe Harbour pact between the US and EU, which was ruled invalid by the Court of Justice of the European Union (CJEU) last October.

The deal was necessary to facilitate transatlantic data flows because the US doesn't meet EU standards for data protection. But mass surveillance disclosures from NSA whistleblower Edward Snowden eventually led to Europe's top court concluding that even Safe Harbour wasn't safe enough.

The proposed Privacy Shield replacement, too, has received widespread criticism—the body of national data protection authorities (Article 29 Working Group), MEPs, and the European Data Protection Supervisor have all called for improvements to the text.

They noted, in particular, the possibility of US authorities to carry out mass surveillance for national security purposes, the questionable independence of a proposed US ombudsperson to oversee redress for Europeans whose data has been misused, and the complexity of that redress mechanism itself.

At Monday’s meeting there were some suggestions for a centralised EU body for handling complaints to the ombudsperson: a conduit to supposedly make the process easier for EU citizens.

“However there was no clear indication who that would be," our source said. "Possibly it would involve national data protection authorities.

"It would make sense for it to possibly be the European Data Protection Board [due to be established under the new General Data Protection Regulation], but that hasn’t been formally proposed by the commission, so it’s still very vague about how such a body would work.”

The department of shields, harbours, and umbrellas

The commission is working very hard to negotiate with the US, the source continued, “at least partly because it is so embarrassed by the CJEU ruling striking down Safe Harbour. To a certain degree they can only do so much. From the point of view of member states, however, there is a feeling that they have reaped what they sowed and are now asking the member states to bail them out. That said, I don’t really think it’s in anyone’s interests to block the shield.

“From the US side they are genuinely concerned about tying the hands of a new administration. I really think it’s a case of who blinks first.”

Our source added:

A few things would really make the difference to what I think we could accept—better language on bulk versus targeted surveillance and on automated processing. On the latter, some of the language from the recently signed Umbrella Agreement [on data sharing between the EU and US for law enforcement] could be acceptable. People are doing their best, but there is frustration. Almost all the member states are on the same page in wanting to get this done. Austria perhaps has some more reservations, but broadly there is unity. With so many moving parts, however, it would be more surprising if it didn’t take a lot of time. There are two more meetings scheduled for June 20 and 29, but I would anticipate a few more in July. Look at what happened with the last deadline set by Article 29 to replace Safe Harbour by the end of January: we had an announcement on February 2, so don’t be surprised if this is only concluded the day before the summer break.

A Brussels official told Ars that the commission was "now in the process towards adoption by the College of Commissioners; once Article 31 will give their consent, the commission will then adopt the adequacy decision."

In plain English, an adequacy decision would allow data to be transferred from the EU's 28 member states, and Norway, Liechtenstein, and Iceland—the trio of counties outside of the bloc that fall under the European Economic Area—to a string of "third nations" including the US, without any further safeguards. Under this decision, the commission has previously recognised the Safe Harbour agreement, and the transfer of air passenger name record (PNR) data.

The EC spokesperson added: "The commission is working to incorporate a number of useful recommendations by the data protection authorities into the Privacy Shield. Some of these recommendations can only be addressed in agreement with the US government and we are in discussions with them on those points. We have updated the member state experts of Article 31 working party, who support us in this approach."