The ECJ addressed the transfer of data from an EU country to a third country. The court decided that the EU-US Privacy Shield, an implementing act by the Commission, was invalid. The US surveillance measures are not limited to what is strictly necessary, do not guarantee the independence of an ombudsman, and do not guarantee authorization to make binding decisions against American intelligence agencies for an ombudsman (ECJ C 311/18 dated 16.07.2020).