BRUSSELS—Transatlantic data flows between Europe and the US continue to face an uphill struggle after a meeting of EU national representatives failed on Thursday to reach an agreement on the so-called Privacy Shield deal—Safe Harbour's would-be successor.

Mid-level diplomats who sit on the Article 31 committee—made up of representatives of all member states and chaired by a European Commission official—have power of veto over the whole agreement. They concluded that more time was needed to consider the implications of the proposal.

Privacy Shield has been heavily criticised by Europe’s data protection watchdogs who said that although it was an improvement over the now-defunct Safe Harbour arrangement with the US, too many details were unclear, and potentially open to abuse.

In April, the Article 29 working group of EU data regulators concluded that exceptions in the proposed Privacy Shield framework to allow the US to carry out mass surveillance of EU citizens were "not acceptable."

A commission source told Ars that work “is going forward well" with the Article 31 group.

"There was a very constructive meeting today, and I suspect there will be a few more in the course of May and early June," the source added.

"The commission had said directly after the Article 29 [opinion (PDF) on Privacy Shield] that we would incorporate a number of useful recommendations by the data protection authorities. This is what we are doing now and updating the Article 31 on the ongoing work.”

Brussels' officials hope that the Article 31 group will consent to the deal before the end of June, however the commission chair has no vote in the committee. It must vote in favour by a qualified majority—16 member states representing at least 65 percent of the European Union population.

If they vote against it, or fail to reach a consensus opinion, the commission has three options: it can drop the proposal (which definitely won’t happen), it can appeal against the outcome of the vote, or it can submit a revised draft.

The Privacy Shield deal is seen as critical to give international companies some security when transferring the personal data of EU citizens to the US. The voluntary Safe Harbour scheme had been drawn up because the US doesn't meet the European adequacy standard.

Since Safe Harbour was thrown out by Europe's highest court the CJEU last October, businesses have been in legal limbo.

But it's now clear that data protection authorities and the European Parliament—which must also weigh in with an opinion—won't rubber stamp a weak proposal regardless of the disruption.