Facebook signage Photo: Jason Doiy/ALM Media

In a mixed-bag judgment delivered on Thursday, Europe's highest court gave its blessing to the mechanisms used by companies to transfer European personal data around the world but struck down a major data protection deal agreed between the U.S. and the EU just four years ago, known as the Privacy Shield.

The judgment handed down by the European Court of Justice—which brings a layer of finality to the long running wrangle between Facebook and Austrian activist Max Schrems—means that companies like Facebook can continue to lawfully transfer European customer data to other parts of the world. 

EU and U.S. authorities, however, have essentially been tasked by the Luxembourg-based court with drawing up a new data protection deal at a time when transatlantic relations are already strained. 

The judges ruled that the so-called 'standard contractual clauses' that legally underpin companies' transfers of personal data outside the 27-member bloc do not violate EU law. The court instead took issue with the Privacy Shield agreed between the U.S. and the EU in 2016, arguing that it does not offer European residents recourse to an independent body that offers the guarantees granted by the EU General Data Protection Regulation (GDPR) and that can take decisions that would be binding on U.S. intelligence services. 

The Privacy Shield was adopted by the U.S. and the EU after the European court struck down its predecessor, the Safe Harbour agreement, following a 2013 complaint brought by the Austrian privacy activist Max Schrems. 

The case decided on Thursday stems from another challenge brought by Schrems before Ireland's High Court, where Facebook's European headquarters are located.

Schrems, a Facebook user since 2008, contends in his complaint that the U.S. does not sufficiently protect the personal data of European citizens transferred to the country. The case made it to the Luxembourg-based European Court of Justice after the Irish court decided to seek guidance on the interpretation of the GDPR and the validity of the Privacy Shield in a preliminary ruling request. 

Lisa Peets, partner at Covington & Burling's office, said the judgment means that the 5,000 or so U.S. companies signed up to the Privacy Shield will have to find an interim solution until EU and U.S. officials have worked out a new data protection deal.

"The invalidation of the Privacy Shield will keep data protection lawyers busy as clients consider the impact of the judgment and the need for alternate transfer mechanisms," she said in a written statement.

Peets added that the court's finding that the standard contract clauses are legally sound would nonetheless be welcomed by many businesses. "This will be a huge relief to companies across Europe," she said. 

The European Commission, Max Schrems and Facebook did not respond to requests for comment.

Read More

Facebook's Data Transfer from EU to US is Legal, Top EU Court Adviser Says

Top EU Court Hears Arguments in Privacy Case That Could Upend Transatlantic Data Transfers