EU official: New Privacy Shield draft in July

The European Union and the U.S. have hammered out the most contentious issues in a pending transatlantic data flow agreement and a new draft is forthcoming, EU Justice Commissioner Vera Jourova told a European news outlet.

The EU Commission is set to present the new draft in early July, Jourova told EUobserver.

{mosads}The two sides have reached an agreement on bulk collection of personal data for national security purposes — a longtime sticking point — but still need to to agree on how long the firms can retain data, and for what purpose.

“We reached an accord on more precise listing of cases when bulk collection can occur and a better definition of how our American partners understand the difference between bulk collection which may be justified, and mass surveillance without any purpose, which is not tolerable,” Jourova said.

“These specific points have already been finished and put down in written form,” she continued, adding that “we want to make sure that personal data will only be kept for that period which is necessary and to agree on exceptions which enable them to keep data for a longer time.”

The agreement — called the Privacy Shield — is intended to replace a 15-year-old framework used by U.S. companies to make legal transfers of personal data across the Atlantic. The old Safe Harbor arrangement was used by over 4,000 companies, from hospitality to social media, to meet Europe’s more stringent privacy requirements for handling citizens’ data.

The EU high court struck down the agreement in October, on the basis that the U.S. could not be seen to adequately protect privacy because of its surveillance practices.

Negotiators have been struggling to craft a replacement to the critical deal, but have faced an uphill road in convincing Europe’s 28 data privacy regulators. The bloc’s lead watchdog in May said a draft deal struck in February needs “robust improvements.”

“I appreciate the efforts made to develop a solution to replace Safe Harbor but the Privacy Shield as it stands is not robust enough to withstand future legal scrutiny before the [European high court],” European Data Protection supervisor Giovanni Buttarelli said in a statement.

Critics have long warned that unless the U.S. overhauls its privacy and national security laws, no legal framework could stand up in European courts.