The European Commission has published a draft adequacy decision to allow citizen data to flow freely across the Channel – but the victory isn’t total yet.