EU court sides with activist in Facebook data transfer fight

An visor to European Union’s top court on Thursday sided with an Austrian privacy campaigner waging a long-running legal battle against Facebook over its personal data transfers to U.S.

European Court of Justice’s vocate general backed Max Schrems’ argument in a case focusing on wher Facebook’s Dublin-based subsidiary can legally transfer users’ personal data to U.S. parent company.

At issue were so-called standard contractual clauses, which vocate General Henrik Saugmandsgaard Oe said in a preliminary opinion are valid for protecting consumers’ data privacy when companies transfer data outside EU for processing.

“ opinion is in line with our legal arguments,” Schrems said in a statement.

legal saga’s origins date to 2013, when Schrems filed a case following revelations by former NSA contractor Edward Swden of electronic surveillance by U.S. security ncies, including disclosure that Facebook gave ncies access to personal data of Europeans.

Schrems, concerned that his personal information was at risk, h challenged data transfers through courts in Ireland, home to Facebook’s European hequarters.

Irish Data Commissioner h issued a preliminary decision that transfers may be illegal because standard contractual clauses that govern data transfers don’t equately protect consumers’ data privacy. clauses are data protection agreements approved by EU’s executive Commission in which businesses commit to abide by bloc’s stringent privacy standards, including protecting personal data.

Irish authorities eventually asked ECJ, which is based in Luxembourg and is EU’s top court, for a ruling on wher se contractual clauses comply with European rules.

A final ruling from court’s judges, who often follow vocate general’s opinion, is expected later.

Schrems doesn’t have a problem with data agreements per se but said commissioner can, under law, take a more measured approach by halting data transfers in individual cases, like Facebook’s.

Saugmandsgaard Oe agreed, saying that clauses allow for data flows to be suspended or prohibited if re’s a conflict with a third country’s law.

Facebook and Irish Data Protection Commission did t immediately respond to requests for comment.