In 2013, Austrian law student and privacy activist Maximilian Schrems sued Facebook, alleging the social media giant violated the EU Data Protection Directive when it shared EU citizen data with the U.S. National Security Agency. Over 25,000 European Facebook users signed up to join the class action, with another 60,000 on a waiting list, making it one of the largest privacy suits in history.

Schrem's lawsuit has yet to make it to court, having bounced in and out of EU jurisdictions over the last few years. But the case was the catalyst for a seismic shift in EU policy this fall, and it's looking more certain that it will go forward.

In October, the European Union Court of Justice (EUCJ) reviewed an appeal of the decision to toss Schrem's suit. The court found that the Safe Harbor agreement that precluded the case from being heard by the Irish Data Protection Commission violated EU citizen rights, and ruled the agreement invalid. In doing so, the EUCJ allowed individual member states to apply their interpretation of “reasonable” security measures in governing how data moves in and out of their borders.