EU COURT CANCELS US DATA-SHARING PACT OVER SNOOPING CONCERNS

The European Union’s top court ruled Thursday that an agreement that allows thousands of companies — from tech giants to small financial firms — to transfer data to the United States is invalid because the American government can snoop on people’s data.

The ruling to invalidate Privacy Shield will likely complicate business for around 5,000 companies, and it could require regulators to vet any new data transfers to make sure Europeans’ personal information remains protected according to the EU’s stringent standards.

It will no longer simply be assumed that tech companies like Facebook will adequately protect the privacy of its European users’ data when it sends it to the U.S. Rather, the EU and U.S. will likely have to find a new agreement that guarantees that Europeans’ data is afforded the same privacy protection in the U.S. as it is in the EU.

Privacy activists hailed the court ruling as a major victory, while business groups worried about the potential to disrupt commerce, depending on how the ruling is implemented. Companies like Facebook routinely move such data among their servers around the world and the practice underpins billions of dollars in business.

“It is clear that the U.S. will have to seriously change their surveillance laws, if U.S. companies want to continue to play a major role on the EU market,” said Max Schrems, an Austrian activist whose complaints about the handling of his Facebook data triggered the ruling after years of legal procedures.

He first filed a complaint in 2013, after former U.S. National Security Agency contractor Edward Snowden revealed that the American government was snooping on people’s online data and communications. The revelations included detail on how Facebook gave U.S. security agencies access to the personal data of Europeans.