Safe Harbour 2.0, currently being drawn up by the EU and US authorities, "will not provide a viable framework for future transfers of personal information" across the Atlantic according to a group of human rights and privacy organisations. In a letter sent to the European Commissioner for Justice, Consumers and Gender Equality, Věra Jourová, and to the US Secretary of Commerce, Penny Pritzker, the 20 EU and 14 US NGOs instead urge the politicians "to commit to a comprehensive modernization of privacy and data protection laws on both sides of the Atlantic."

Time is running out to come up with a replacement for the original Safe Harbour framework, which was effectively struck down by the Court of Justice of the European Union (CJEU) in October. The important Article 29 Working Party, composed of representatives from the national data protection authorities in EU countries, warned that they would not wait for long before acting on the CJEU decision: "If by the end of January 2016, no appropriate solution is found with the US authorities and depending on the assessment of the transfer tools by the Working Party, EU data protection authorities are committed to take all necessary and appropriate actions, which may include coordinated enforcement actions."

Moreover, as Ars reported a few weeks ago, German data protection authorities have already started investigating data transfers from the EU to the US by companies such as Facebook and Google, and may proceed to issuing orders for those data flows to be halted.

The European Commission has been aware for years that the original Safe Harbour scheme was unsatisfactory. In a communication published in November 2013, it wrote: "There has been a growing concern among some data protection authorities in the EU about data transfers under the current Safe Harbour scheme. Some Member States' data protection authorities have criticised the very general formulation of the principles and the high reliance on self-certification and self-regulation. Similar concerns have been raised by industry, referring to distortions of competition due to a lack of enforcement." Edward Snowden's revelations of mass surveillance on EU citizens made the need for reform even more pressing.

As well as listing some of the worst problems, the European Commission's 2013 document went on to make 13 recommendations for improving Safe Harbour. However, these were all formulated before the CJEU judgment on the case involving Facebook and Max Schrems.

According to the new letter penned by the NGOs, the situation is very different now: "Viewed in light of the Schrems decision as well as the experience of consumer organizations on both sides of the Atlantic, it is clear that these [13] principles will do little to reestablish trust for consumers."

More problematically, the human rights and privacy organisations point out: "A revised Safe Harbor framework similar to the earlier Safe Harbor framework will almost certainly be found invalid by the national data protection agencies and ultimately by the CJEU." That's because the reasons given by the EU's highest court for striking down Safe Harbour would also apply to its replacement by something similar.

What is needed, the NGOs write, is for privacy laws themselves to be updated on both sides of the Atlantic in the light of the CJEU judgment. The letter goes on to offer its own 13 recommendation for how this might be done, which call for "the end of mass surveillance by intelligence agencies", and "the establishment and modernization of legal frameworks that protect fundamental rights," among other things.