Well the Commission can't act contrary to the law. Or, rather, if it does then the CJEU will rule those actions to be invalid if somebody was to bring judicial review proceedings.

The Schrems case stemmed from the fact the the Irish DPA refused to investigate Facebook's transatlantic data transfer because Safe Harbor was in place. Schrems challenged that decision in the Irish High Court, the HC then referred the case to the CJEU which declared the agreement to be invalid because it violated the Charter of Fundamental Rights.