So it looks like this needs (from EU perspective) another round of lawsuits to get this overthrown again - since the oversight by the US DoC is laughable.
Basically the problem with Safe Harbor is Section 702 of the Foreign Intelligence Surveillance Act and Executive Order 12333. The cumulative effect is that all people non US persons are legitimate targets of mass surveillance under US law.
The fix for Safe Harbor was negotiated with Department of Commerce who has no authority to talk about reforming this policy.
Options were
1. Immediately end the ability of US based digital companies to do business in Europe
2. Cave completely and have a few months of normalcy before Europe Commission kills the deal.
You have a significant misunderstanding of the mechanics of this treaty, FISA, and EO12333.
This treaty: it must be ratified by Congress in order for it to be considered accepted by the EC. Under the U.S. Constitution, this means it would carry the full force of the law. The Commerce Department wouldn't bear the weight of enforcement.
FISA §702: limits collection to targeted non-U.S. persons of foreign intelligence interest at borders (Upstream) and submission of NSLs to U.S. organizations for data on non-U.S. persons. The Privacy Shield agreement only prohibits mass surveillance.
EO12333 does not apply since that collection occurs outside of the United States, and would not be in the jurisdiction of this agreement.
> Department of Commerce who has no authority to talk about reforming this policy.
No, this agreement was made at the behest of the Senate Committee on Commerce, Science, and Transportation [1]. Since this will be ratified by the Senate, it will carry the full weight of the law.
And we've seen that US laws aren't worth the paper they're printed on when it comes to curbing the mass surveilance apparatus. Leaving the policing of their own hungry three-letter agencies to the US is a laughable proposal.
