> The agreement will not - it cannot - satisfy the requirements of the GDPR and CFR unless and until the US changes its law.
Or unless and until the EU changes its laws.
Or unless and until the EU changes its laws.
US: "we demand the right to spy on anyone for any reason, except US citizens where we absolutely must recognize their constitutional rights"
EU: "we demand basic protections for the rights of our citizens"
For another, if one looks past my vague wording, the EU (or at least Germany, which I'm most familiar with) doesn't have the dogma that it's required to set up a world spanning total surveillance state, no compromises beyond the ones absolutely necessary with their own constitution (and even those are followed within a rather "liberal" framework for the three-letter-agencies: they do have all possible data they can get their hands on, just pinky-promise to not abuse it, if US citizens are impacted, in the eyes of secret courts).
[0]: https://law.yale.edu/sites/default/files/area/center/china/d...
The reason we have regulations is that the opposite proved to be true.