The European Union's top court has ruled that a key EU-US data deal relied on by companies such as Facebook is invalid in the light of spying revelations in the Edward Snowden scandal.
"The Court of Justice declares that the [European] Commission's US Safe Harbour Decision is invalid," it said in a decision on a case brought against Facebook by Austrian law student Max Schrems.
The court said Irish authorities now had to decide whether transfer of data from Facebook's European subscribers to the United States should be suspended "on the ground that that country does not afford an adequate level of protection of personal data."
Schrems brought his case against the Irish data protection authority after it rejected his complaint over Facebook's practice of storing user data in the US.
The complaint focuses on the Safe Harbour deal signed in 2000 between Brussels and Washington that allows data transfers by thousands of businesses on the grounds that US laws offer similar protection to those in the 28-nation European Union.
Schrems, a right-to-privacy campaigner, filed the case against Ireland's data protection authority because Facebook's European headquarters are based there.
He had argued that the 15-year-old Safe Harbour deal is too weak to guarantee the privacy of European residents in the wake of details provided by Snowden.
"YAY," Schrems tweeted after the judgment.
The court added that legislation permitting public authorities to have access on a generalised basis to the content of electronic communications must be regarded as "compromising the essence of the fundamental right to respect for private life".
"Likewise, the court observes that legislation not providing for any possibility for an individual to pursue legal remedies in order to have access to personal data relating to him, or to obtain the rectification or erasure of such data, compromises the essence of the fundamental right to effective judicial protection, the existence of such a possibility being inherent in the existence of the rule of law.
"Finally, the court finds that the Safe Harbour decision denies the national supervisory authorities their powers where a person calls into question whether the decision is compatible with the protection of the privacy and of the fundamental rights and freedoms of individuals."
The judgment will be sent to the High Court in Dublin where the judge will use it as the basis for deciding on Schrems's legal challenge for Facebook to be audited.
Snowden, a former NSA contractor now in exile in Russia, triggered a wave of controversy when he leaked tens of thousands of documents about surveillance programs run by the US intelligence services and foreign counterparts in 2013.