Privacy Shield, the replacement for the Safe Harbour deal agreed in February between the European Union and the US, is still not good enough, according to EU data protection authorities.
The Article 29 Working Party, an umbrella group of EU national data protection authorities, believes that Privacy Shield is an improvement on Safe Harbour but that its protections still aren't sufficient to make it compliant with EU law.
The new redress mechanism is welcome, in theory, but the group said that it may not be practical and will therefore prove ineffective.
In addition, the Working Party is concerned that Privacy Shield will do little to counter the risk of "massive and indiscriminate collection of personal data originating from the EU", even if it is acceptable when EU governments do it.
"Overall, the Working Party welcomes the significant improvements brought by the Privacy Shield compared to the Safe Harbour decision," said the group in a statement (PDF).
"In particular, the insertion of key definitions, the mechanisms set up to ensure the oversight of the Privacy Shield list and the now mandatory external and internal reviews of compliance are a positive step forward.
"However, the Working Party has strong concerns on the commercial aspects and the access by public authorities to data transferred under the Privacy Shield."
These include "an overall lack of clarity" and of wording covering automated processing, and the fact that some key EU data protection principles are absent from the Privacy Shield agreement "or have been inadequately substituted by alternative notions".
"Because the Privacy Shield will also be used to transfer data outside the US, the Working Party insists that onward transfers from a Privacy Shield entity to third-country recipients should provide the same level of protection on all aspects of the Shield (including national security) and should not lead to lower, or circumvent, EU data protection principles," said the statement.
It goes on to express concerns that the online collection of data for commercial purposes could, and probably is, being mixed up with the collection of data by the authorities in their fight against terrorism.
The establishing of an ombudsman may help, the Working Party suggested, but "this new institution is not sufficiently independent and is not vested with adequate powers to effectively exercise its duty and does not guarantee a satisfactory remedy in case of disagreement".
Samsung very much in third place behind Android Pay and Apple Pay
Moribund Twitter ads nil, nada, zero users, while revenues fall five per cent to $574m
Wisconsin claims deal could result in 13,000 jobs and $10bn of investment from Foxconn by 2020
Streaming music is the future, whether you like it or not