In landmark Facebook case, Europe's top court scraps key EU-U.S. consumer data transfer pact

On Tuesday, the European Court of Justice, the European Union's highest court, threw out a 15-year-old agreement allowing companies to transfer data freely between the U.S. and EU. The ruling, which can't be appealed, appears to prohibit Facebook, Google, and other tech companies large and small from moving data about their European customers to the United States, and nobody is quite sure what will happen next.

The case was started by an Austrian law student, Max Schrems, who sued Facebook in Ireland — Facebook's European headquarters — arguing that due to revelations by U.S. National Security Agency contractor Edward Snowden, European consumer data wasn't given adequate privacy protections by Facebook and other U.S. tech companies. The ECJ agreed, immediately invalidating a "safe harbor" agreement in place since 2000 that allows about 4,000 U.S. and European companies to transfer data overseas on the understanding that that data will be given the privacy safeguards applicable to each country's consumers.

Under the new ruling, national regulators will be able to judge whether companies meet their national privacy rules, and stop them from transferring data if they don't. "Companies may not be able to move people's data until domestic data protection authorities give their approval," London privacy lawyer Marc Dautlich tells The New York Times. "In some of Europe's 28 countries, that is not going to be easy."

The Week

Escape your echo chamber. Get the facts behind the news, plus analysis from multiple perspectives.

SUBSCRIBE & SAVE

Sign up for The Week's Free Newsletters

From our morning news briefing to a weekly Good News Newsletter, get the best of The Week delivered directly to your inbox.

From our morning news briefing to a weekly Good News Newsletter, get the best of The Week delivered directly to your inbox.

Sign up

The court's decision, and stalled two-year-old negotiations for a new safe harbor agreement highlights "the different approaches to online data protection by the United States, where privacy is viewed as a consumer protection issue, and Europe, where it is almost on a par with such fundamental rights as freedom of expression," notes The New York Times. The European Commission is expected to address the ruling on Tuesday.