By EU law there has to be “essentially equivalent protection” in the destination country, so this might as well be clickbait by the EU Commission as FISA 702 is absolutely incompatible with GDPR. One of those two needs to go before CJEU will allow this. This is likely Big Business and Three Letter Agency lobbyism at work, to try to draw out the final break-up of the very one-sided data transfers. It won't stick unless US gives non-US citizens constitutional rights (as if).