The torrent of news stories about cyberattacks and data breaches never seems to slow, but law-enforcement agencies have tallied some significant victories against online criminals. Websites spewing Islamic State propaganda have been sidelined, thanks to joint efforts by American and European authorities. So have sites on the “dark web” selling illegal drugs, hacking for hire, and other unsavory items and services.

Unfortunately, this good work will now be significantly hindered as the European Union begins to enforce its General Data Protection Regulation. As written, the GDPR will restrict the types of data that companies can share— even, perhaps inadvertently, with law enforcement. 

Read more: The EU’s Gift to Cybercriminals