[ArsTechnica] Privacy Shield doesn’t do enough to curtail US surveillance, say EU data watchdogs

Exceptions in the proposed EU-US Privacy Shield framework that would allow the US to carry out mass surveillance of EU citizens are "not acceptable," the Article 29 Working Party of EU data protection authorities said today in a press conference.

The Chairman of the group, Isabelle Falque-Pierrotin, explained that the Article 29 Working Party would look with "great interest" on the forthcoming ruling by the Court of Justice of the European Union (CJEU) on whether mass surveillance of EU citizens could be legal. If the CJEU finds that the surveillance carried out by GCHQ is unlawful, it would have a big impact on the national security exceptions included in Privacy Shield. [...]

Since Safe Harbour was struck down by the CJEU largely because of concerns about mass surveillance, there is a real possibility that Privacy Shield will suffer the same fate unless the the Article 29 Working Party's concerns are adequately addressed. That would lead to even greater uncertainty for transatlantic data flows—something the European Commission and US companies will be keen to avoid.