Isn't this a new Schrems situation? Just because the commission can make a law doesn't mean that it's legal. Seems like it would certainly interfere with the European Convention on Human Rights that grants everyone right to privacy of it's personal life and correspondence – meaning the CJEU would overthrow this law in an instance?