EU countries should be able to block US spies from accessing their citizens' data, the ECJ has said, in what is being billed as a landmark ruling.
The so-called Safe Harbor agreement between the US and Europe allows the National Security Agency (NSA) to use the Prism surveillance system exposed by whistleblower Edward Snowden to wade through the personal data and communication records of EU citizens held by nine internet giants.
However, issuing his opinion on the case of Austrian campaigner Max Schrems, who challenged Facebook over the transfer of his personal information to American intelligence agencies, ECJ Advocate General Yves Bot said today that the agreement does not stop EU data privacy watchdogs from investigating complaints or bar them from suspending the transfers.
A final ruling by the ECJ's 15 judges on the case is expected later this year and while Bot's opinion is not binding, the court's final decision normally follows his initial assessment.
"After an initial review of the advocate general's opinion of more than 40 pages it seems like years of work could pay off. Now we just have to hope that the judges of the Court of Justice will follow the advocate general's opinion in principle," said Schrems.
He added that while his case was specific to Facebook it may also apply to other tech giants operating in Europe like Apple, Google, Yahoo and Microsoft and could have major implications for EU-US data flows.
In the 44-page opinion, Bot warned that the European rules which govern the agreement are invalid and said internet users in Europe have no effective judicial protection while the large scale data transfers are happening.
"The access of the United States intelligence services to the data transferred covers, in a comprehensive manner, all persons using electronic communications services, without any requirement that the persons concerned represent a threat to national security," he wrote.
"Such mass, indiscriminate surveillance is inherently disproportionate and constitutes an unwarranted interference with the rights guaranteed by Articles 7 and 8 of the Charter (of Fundamental Rights of the European Union)."
The European Commission said 13 revisions to Safe Harbor have been adopted in a bid to restore trust and officials are also said to be confident a deal can be done soon with the US on a new arrangement over the transfer of data.
Vera Jourova, European commissioner for justice, consumers and gender equality, said: "My aim is to ensure that European consumers' personal data is effectively protected in practice. A strengthened Safe Harbor will restore trust in EU-US data flows. I am confident that we will be able to soon conclude our work on strengthening the Safe Harbor arrangement."
The ECJ opinion could see consumers in Europe lose out on new services that require data transfers to the US or elsewhere, according to DigitalEurope, which lobbies for tech firms in Brussels.
John Higgins, director general, said: "We are concerned about the potential disruption to international data flows if the court follows today's opinion. In addition to the disruption a court ruling would have on international data flows, it would also frustrate the creation of the Digital Single Market in Europe because it would fragment Europe's approach to data flows out of the EU."
Schrems' challenge to seek an investigation into what data of his was sent to US spies by Facebook will come back to the High Court in Dublin after the ECJ issues its final ruling.