The draft text of an agreement between the EU and the US to establish a new self-certification framework governing transatlantic data flows aimed at ensuring data protection and privacy compliance when Europeans’ data is taken to the US for processing has now been published. But questions remain over whether the deal is robust enough to pass muster.