The U.S. government needs to do more to protect the personal data of EU citizens that is transferred to U.S. companies, the EU's most senior justice official said on Wednesday.

Vĕra Jourová, the European Commissioner for Justice, presented the third report on the Privacy Shield, an agreement that extends EU data protection rules to information transferred to U.S. companies.

"We would like to see the U.S. do certain things faster and better," she said.

The Privacy Shield was agreed to by the EU and the U.S. in 2016 as a successor to the Safe Harbor agreement, which was ruled illegal by the EU's Court of Justice following a legal challenge after NSA whistleblower Edward Snowden revealed U.S. government agencies were helping themselves to digital data from internet companies. The court found that the Safe Harbor agreement did not adequately protect citizens' data.

Jourová said there has been "good progress" made with implementing the Privacy Shield provisions since the second status report in 2018, and the agreement was a "good tool of digital diplomacy" and "an example of still-successful transatlantic cooperation".

But she said there are a number of areas where she wants to see U.S. authorities take action to improve compliance and enforcement. For example, they should speed up the process of recertification, she said, noting that in some cases, companies have remained on the Privacy Shield certified list for up to three and a half months after their certification expired. The commission wants this period shortened to 30 days.

Jourova also said compliance checks should be expanded and there should be greater cooperation with EU data protection authorities, as this could help U.S. companies understand their obligations.

But she also highlighted signs of progress, including the appointment by U.S. authorities of Kevin Krach as permanent Privacy Shield ombudsperson in January.

"With the ombudsperson, the whole structure of oversight and supervision we developed when negotiating the Privacy Shield is now fully in place," she said.

Jourová also said she considers the Privacy Shield agreement a "success story", as about 5,000 companies have signed up.

"In its first three years of operation, the Privacy Shield has more participating companies than its predecessor, the Safe Harbor arrangement, had obtained after 13 years of existence," she said.

She also praised a tougher approach to enforcement of the scheme by U.S. authorities, noting that the Federal Trade Commission (FTC) had taken enforcement action in seven cases. These involved companies that had falsely claimed they were complying with the privacy rules, and a decision by the FTC to fine Facebook $5 billion for breaches of privacy rules.

Despite Jourová's praise, the long-term survival of the Privacy Shield is still in question. A pending legal challenge that initially targeted Facebook's use of another EU data transfer mechanism was broadened to include legal questions over the Privacy Shield. A decision is pending at the Court of Justice of the European Union, the EU's top court, which will decide whether the Privacy Shield is fundamentally incompatible with EU law because U.S. national security priorities allow the government to use people's data.

In addition, separate litigation that directly targets the Privacy Shield was brought by a French digital rights group that is arguing it is not compatible with EU law because of U.S. government mass surveillance practices.