We already have ECJ verdicts lying around, that when read strictly declare the USA unsafe for GDPR data, basically due to fundamental legal issues. Our politicians and industry do not want to really apply it, but it's just a question of time till the current DC-Brussels circumvention strategy lands before the ECJ again, and it's only a question how explicit the court will be next time in its opinion.