The European Court of Justice (ECJ) has declared that the EU-US Safe Harbour Decision is invalid, meaning that US tech companies could come under increased scrutiny in their management of data.
The EU and the US made the agreement in 2000 to allow US firms to get data from Europe without violating stringent EU rules on the matter. These prevent data from going to countries without adequate privacy protections.
The decision means that individual countries will be able to set their own regulation for how US companies handle their citizens’ data as it will no longer be covered under the agreement.
It will affect over 4500 countries that transfer data between the two regions.
The case was initially brought by an Austrian privacy campaigner, Max Schrems, to the Irish Data Protection Commission over concerns that Facebook was giving data to US cyber-spies.
The matter was referred to the ECJ after the Commission said that transfers were covered by Safe Harbour.
