In a move that has surprised no one, Europe’s privacy chief has slammed the planned EU-US agreement to facilitate the flow of personal data across the Atlantic.

The so-called Privacy Shield has faced a struggle for acceptance ever since it was proposed to replace the Safe Harbour agreement that was struck down by the European Court of Justice (ECJ) last October.

On Monday evening the European Data Protection Supervisor (EDPS), Giovanni Buttarelli, said that while he appreciates the efforts made to develop a solution to replace Safe Harbour", "the Privacy Shield as it stands is not robust enough to withstand future legal scrutiny before the court."

Andreas Splittgerber, partner and head of Olswang's German data protection practice agreed, telling Ars that if the European Commission, which negotiates on behalf of the EU, makes only minor improvements to the text “in case of a test before the ECJ, privacy shield would hold with a likelihood of 60 to 70 percent.”

Splittgerber added that the pressure on the Commission has been further increased as the Irish Data Protection Commissioner has asked the court to rule on standard contractual clauses and model clauses, the most frequently used “workaround” by companies that transfer personal data between the EU and the US.

“This does not grant sufficient legal security to companies that transfer data between the EU and the US in the course of their business operations. Given the recent developments, the EU Commission and the US FTC might (and hopefully will) now stick their heads together to fix the issues,” he said.

Buttarelli also said “significant improvements are needed should the European Commission wish to adopt an adequacy decision. Moreover, it’s time to develop a longer term solution in the transatlantic dialogue.”

The EDPS’ main concerns echo those of national data protection authorities. “Data in transit or transferred to the US may routinely be assessed by law enforcement and intelligence bodies,” he said, pointing out that “in the EU we do not discriminate on the basis of nationality.” The current Privacy Shield text foresees rights of redress in the case of a breach of privacy laws for EU citizens only, not non-European citizens living in the EU.