That's exactly why the privacy shield was invalidated by the CJEU.