The European Data Protection Supervisor (EDPS) has said a data transfer pact between the EU and US needs "significant improvements", the BBC reports.
The EU-US Privacy Shield agreement was supposed to safeguard EU citizens' personal information when stored in the US.
The agreement was designed to replace the Safe Harbour pact, which the EU Court of Justice ruled invalid in 2015.
But the EDPS Giovanni Buttarelli warned Privacy Shield was "not robust enough".
"I appreciate the efforts made to develop a solution to replace Safe Harbour but the Privacy Shield as it stands is not robust enough to withstand future legal scrutiny," he wrote in a statement.
Mr Buttarelli's statement does not mean the agreement will be scrapped, but his concerns echo those expressed by European privacy regulators in April.
The Privacy Shield agreement, negotiated by the United States and the European Commission, was intended to be ratified in June.
Safe Harbour referred to an agreement struck between the European Union and United States, designed to provide a "streamlined and cost-effective" way for the US firms to get data from Europe without breaking the EU rules. It was introduced in 2000.
The EU forbids personal data from being transferred to and processed in parts of the world that do not provide "adequate" privacy protections.
Safe Harbour allowed the United States companies to self-certify that they had taken the necessary steps to protect data, to avoid having to seek permission for each new type of transfer.