After months of eager anticipation the Court of Justice of the European Union (CJEU) delivered its decision in Schrems II, the latest chapter in the ongoing tug-of-war between US laws that demand surveillance and EU data protection laws that require privacy.