Those in the know are placing bets on Privacy Shield being finalised sometime in July.

The European Commission had originally insisted the deal would be done by June, but that was to reckon without stern criticism from national data protection authorities in the Article 29 Working Party, the European Data Protection Supervisor, and MEPs in the European Parliament.

Far from hailing Privacy Shield as a great improvement on Safe Harbour, as some more naive Commission staff had hoped, they bemoaned the lack of concrete improvement and demanded clarification on multiple points. But the real battle takes place in the Article 31 group.  

The formerly little-known committee is made up of national representatives who must vote to approve the deal before it can be enforced in law - something Justice Commissioner Vera Jourova appeared to have forgotten in a recent interview with Brussels publication EU Observer. She asserted the updated deal would enter into force “straight away” once negotiations with the U.S. are concluded.

Following their latest meeting on Monday, June 20, the IAPP has learned that the Article 31 group is getting increasingly frustrated at not having the updated text. Following the opinion of Article 29, the Commission has gone back to U.S. negotiators to push for concessions on issues including independence of the proposed Ombudsman, judicial redress for non-Europeans living in the EU and the question of “bulk data collection” for national security purposes. The Commission had dropped heavy hints to Article 31 that it would receive a new draft at its June 6 meeting, but that did not happen. Nor did it again on Monday.

On Wednesday, June 22, European Commission Vice President Andrus Ansip met with U.S. Secretary of Commerce Penny Pritzker in Mexico to discuss the deal. He said that the deal would be “wrapped up in July,” but sources in Article 31 insist they will not simply rubber stamp a new deal without thoroughly reviewing it. “We are entitled to 14 days and we will need that time,” said one source.

The Commission insists that Privacy Shield is not a hastily put together replacement for Safe Harbour, but rather a deal that has been years in the making ever since the Snowden disclosures.

Jourova told the EU Observer that negotiators had recently “reached an accord on more precise listing of cases when bulk collection can occur and a better definition of how our American partners understand the difference between bulk collection which may be justified and mass surveillance without any purpose, which is not tolerable.” It seems a little late in the day to be tackling such basic points.

Meanwhile at its Monday meeting, Article 31 representatives ironed out “a few textual amendments, but not much else,” according to a source.

Sources told the IAPP that there is frustration in the group that things are not moving more quickly.

Two more meetings have been scheduled on June 29 and July 4. Most insiders predict that the newly-negotiated text will be presented at the latter meeting  in order to get it delivered before August. Using text that already appears in the new General Data Protection Regulation and the Data Protection Directive on law enforcement as well as other existing laws and treaties may be a way to expedite approval from Article 31 said one diplomat.

Remember without their say-so, the whole deal can be thrown out.

 Top image courtesy of the European Commission