This week the European Union will approve Privacy Shield, an agreement with America allowing companies to transfer personal data across the Atlantic. In October the European Court of Justice struck down Safe Harbour, the pact’s predecessor, arguing that it did not sufficiently protect against bulk collection of European data by American spooks such as the National Security Agency. Yet the new agreement, which includes the creation of a State Department ombudsman to review EU privacy complaints, may never be fully implemented. Some national regulators in the EU, concerned about loopholes that could allow easy access to European data, are likely to file legal cases against it. And Brexit throws another spanner in the works—once outside the EU’s legal umbrella, Britain would have to strike its own deal with the continent. That wouldn’t be easy: some in Brussels think British surveillance practices are even worse than those of the Americans.