The Privacy Shield was invalidated mainly because it didn’t do enough to stop mass surveillance from U.S. national security agencies, and there wasn’t a good way for EU citizens to seek redress over mishandled data.