The European Data Protection Supervisor (EDPS) will issue his opinion on the controversial Privacy Shield proposals on Monday and negotiators shouldn't expect an easy ride.

Speaking at the presentation of the EDPS annual report on Tuesday, Giovanni Buttarelli said that his view was “in full synergy with the A29 working group opinion” that was issued last month.

“We have serious concerns. We do. But now our task is not simply to copy and paste or repeat what our colleagues have said. We would like to be more proactive by focussing on potential solutions, for example what an 'essentially equivalent test' really means,” he said.

The A29—or Article 29—group is made up of data protection authorities from across the EU and its report was extremely critical of the planned Privacy Shield deal to facilitate the transfer of EU citizens personal data to the US. The Privacy Shield plan was drawn up after the European Court of Justice ruled the Safe Harbour agreement invalid last year, saying that there were not sufficient safeguards for personal data under the voluntary scheme.

The A29 group acknowledged that the proposed Privacy Shield arrangement was an improvement on Safe Harbour, but demanded clarifications on many points. Buttarelli argued that while, certainly, clarifications are needed, Safe Harbour should not “define the parameters” of the debate—the measure by which Privacy Shield should be judged is the current data protection directive he said.

“We approach this file as a critical friend, and on the assumption that a solution for the transfer of data to a strategic partner like the US is needed,” he continued, but added that “robust improvements” to the current text were needed.

Buttarelli also pointed out that while the big tech giants of this world, such as Google, Facebook, and Amazon, can rely on binding corporate rules and model clauses to cover their data transfers to the US, many hundreds of smaller companies need a new solution.

“Whether the Privacy Shield is adopted before or after the summer break, member states will have around nine months to adopt initiatives at a national level, but that will be very close to the full implementation of the new General Data Protection Regulation (GDPR), and we cannot ask companies to change their privacy policies every year,” he said. “We have to think in a future-oriented manner. We have to analyse the impact on other legal instruments.”

Transfer is only one of many data processing operations, he added: “Companies cannot pick and choose the lighter regime of the Privacy Shield if they are doing other data processing. In that case they must still respect the GDPR in its entirety.”