In-house counsel at U.S. companies will need to prove they are not subject to Foreign Intelligence Surveillance Act orders while U.S. and European lawmakers find a new way to transfer data from the European Union to the United States.

In July, the European Union Court of Justice ruled in favor of Austrian privacy advocate Max Schrems in his suit against social media network Facebook. In what is referred to as Schrems II, the high court found that the E.U.-U.S. Privacy Shield Framework that allowed for regulating transatlantic exchanges or personal data was no longer valid. With nobody to hold intelligence agencies accountable for taking personal information, the ruling added that the personal data of European citizens could be intercepted by U.S. intelligence agencies during the transfer.