Establishing a common set of rules for regulating the flow of personal and commercial data between the EU and the U.S. has proved challenging. Perhaps surprisingly so. With the invalidation of the Privacy Shield in 2020, regulators on both sides of the Atlantic went back to the drawing board to design a new legal framework.