Max Schrems, the man who brought down Safe Harbour, has told Ars that although he sees huge problems with Privacy Shield, he probably won’t be the one to challenge it. Instead he’s looking towards the UK, following its vote to leave the European Union.

“Basically it would be a very similar case to the Safe Harbour one and the thrill isn’t there any more,” he joked. “But I really hope someone else will challenge it,” he added. That similarity is at the core of most of the criticism of Privacy Shield.

Safe Harbour—the deal struck between the EU and the US to facilitate the transfer of European personal data to the US—was necessary because the US otherwise doesn't meet EU adequacy requirements for data protection. However, following Edward Snowden’s disclosures of National Security Agency spying, Austrian law student Schrems launched a case against Facebook for not sufficiently protecting his data. Last year his case ended up in the European Court of Justice (ECJ), which ruled that the Safe Harbour framework invalid.

Privacy Shield is the hastily arranged replacement, but despite being welcomed by businesses that are keen to have some legal certainty over data flows, the new deal has faced criticism from national data protection authorities, the European Data Protection Supervisor, and the European Parliament.

Parliament’s own Mr Privacy, Jan Philipp Albrecht MEP, said: “The commission has signed a blank cheque for the transfer of personal data of EU citizens to the US, without delivering equivalent data protection rights. The Privacy Shield framework does not seem to address the concerns outlined by the ECJ in ruling the Safe Harbour decision illegal. In particular the individual rights of consumers are still too weak and blanket surveillance measures are still in place.”

However, while Schrems isn’t keen to fight the same case all over again with Privacy Shield, he is already eyeing another potential battle: “The UK, post-Brexit, would be very interesting,” he told Ars.

“Basically you have the problem so far that it was impossible to bring UK surveillance before the ECJ because of the exception for national security. You can argue how far that exception goes, and if it is actually covered or not, but generally you would have a situation where the UK could claim national security is an exception under the treaties. But it’s only the national security of member states that is protected,” he said, before adding:

If the UK is not a member state any more, you could have a case. Let’s say a German bank is transferring data to the UK, that data would possibly fall under some UK surveillance law. You just have to find a situation like that and then you can go to the bank and say ‘you’re not allowed to transfer my data to the UK any more because I can’t be sure that my data is not spied on’—basically the same case as I did with the US. And, under the current case law, you would essentially have to win. So that is a case that could then put pressure on the UK to give EU citizens certain rights. That’s especially relevant if, as I understand the new Prime Minister, Theresa May, is particularly keen on getting out of the European Convention on Human Rights as well, which would mean you would have no privacy protection in the UK as a European to the best of my knowledge. That would be an interesting case. You also have the issue of all the transatlantic cables. For example, I could sue Austrian Telecom for sending my data through, let’s say, Vodafone UK on some cable and onto the US. If we know that the UK government is basically spying on that cable, the question is can you actually use them any more?

Schrems has clearly been giving this some thought—watch this space.