The European Court of Justice (ECJ) on Tuesday reached the verdict that a transatlantic data sharing agreement, “Safe Harbour,” between the EU and US relied on by companies such as Facebook and Amazon is invalid.
The verdict will have extensive consequences for online companies and may force many firms to change their operations.
The Safe Harbour agreement between the European Comission and the US permits businesses to send personal data concerning European consumers to the US. Nearly 4,400 companies - including Facebook, Google and Amazon - make use of the agreement.
Student Max Schrems brought the case following disclosures two years ago by former US National Security Agency contractor Edward Snowden regarding the NSA's surveillance programs.
Schrems argued to the data protection authority in Ireland, where Facebook has its European head office, that US law doesn't sufficiently protect consumers’ personal data.
The ECJ ruling said, "The safe harbour decision denies the national supervisory authorities their powers where a person calls into question whether the decision is compatible with the protection of the privacy and of the fundamental rights and freedoms of individuals."
"... This judgment has the consequence that the Irish supervisory authority is required to examine Mr Schrems’ complaint with all due diligence and, at the conclusion of its investigation, is to decide whether, pursuant to the directive, transfer of the data of Facebook’s European subscribers to the United States should be suspended on the ground that that country does not afford an adequate level of protection of personal data," it added.
"This is a historic victory against indiscriminate snooping by intelligence agencies, both at home and abroad. In a globalised world, only a strong and binding international framework will ensure our citizens’ personal data is secure," Liberal Democrat MEP Catherine Bearder said, commenting on the judgement.
Following the verdict Max Scherms said,"I very much welcome the judgement of the court, which will hopefully be a milestone when it comes to online privacy.
"It clarifies that mass surveillance violates our fundamental rights."
Safe Harbour went into operation in 2000. It is aimed at providing a profitable way for US firms to get data from Europe without infringing the law.
The EU prohibits transferring personal data to locations that do not maintain sufficient privacy protections. The agreement was designed to allow US firms to self-certify that they meet the required standard.