Recent years have seen the increasing importance of data protection irrespective of the country where the public authority or private company that was dealing with European Union (EU) citizens’ personal data was set up. In the EU, international data transfers are subject to the application of Article 25(6) of the Directive 95/46 which provides for ‘an adequate level of protection’ with the EU legal system. Transfers to the US are assimilated to intra-EU transmissions of data once the companies have self-certified to the adequacy decision. The Privacy Shield was adopted by the Commission on 12 July 2016, after the Court of Justice annulled the former adequacy decision – the Safe Harbour Regime. The aim of this article is to consider whether, in line with Articles 7,8 and 47 of the Charter of Fundamental Rights, the new adequacy decision has succeeded in providing an ‘essentially equivalent’ protection – as required by the Court in the Schrems judgment - to EU citizens in the context of transatlantic data flows. This contribution examines first the reframed scope of the privacy principles and the new judicial remedies, in order to analyse whether Article 47 of the Charter has been effectively addressed. Secondly, the derogations to the privacy principles for national security, law enforcement and public interest purposes have been reviewed in an attempt to alleviate the concerns raised regarding public authorities’ access to personal data. In light of the new guarantees, it will be examined whether massive surveillance is still permissible under US law. Some conclusions will be made regarding the sustainability of this new adequacy decision.