The decision today by the EU’s top court to restrict personal-data transfers to the US has been billed as a blow to the likes of Facebook. But it also has big implications for banks and other financial services firms.

The EU-US “privacy shield framework” was established by the European Commission and the US Department of Commerce in 2016, to legitimise transfers of personal data from the European Economic Arena to the US, and act as a limited adequacy agreement. Only transfers to companies in the US that self-certify under the Privacy Shield framework are covered.