Binding corporate rules for data processors was inserted into the European Commission’s data protection regulation proposal with loopholes built-in which allow for FISAAA surveillance.