META Meta Platforms Inc

LUXEMBOURG—The European Union's highest court on Tuesday struck down a trans-Atlantic data pact used by thousands of companies to transfer Europeans' personal data to the U.S.

The decision by the European Court of Justice will affect around 4,500 companies that use the mechanism known as "safe harbor," which allows firms to transfer data on everything from payroll information to company phone books as long as they comply with Europe's stricter privacy rules.

On Tuesday the ECJ ruled that the EU's data-transfer agreements with a third country, such as the U.S., can't override national regulators' powers to suspend it.

"The [European] Commission did not have the competence to restrict the national supervisory authorities' powers…for those reasons the court declares the Safe Harbor decision invalid," the court said in its ruling.

The EU and U.S. have been working for about two years to reform the data agreement to address Europeans' concerns that their data isn't safe amid claims of U.S. spying, aggravated by allegations by former National Security Agency contractor Edward Snowden.

Companies such as Apple Inc. and Facebook Inc., as well as European companies operating in the U.S. such as German media giant Bertelsmann SE & Co, have been using the 15-year old framework to transfer data to the U.S.

Companies have been bracing for such a decision, following a top court adviser's recent nonbinding recommendation to invalidate the pact.

Yves Bot, an advocate general at the court, had said the agreement should be ditched because "mass, indiscriminate surveillance" by the U.S. suggests that, when Europeans' data flows there, it isn't sufficiently protected. Europeans' rights to privacy and protection of personal data are written into EU law.

The court also adopted Mr. Bot's line in ruling that national regulators have the power to suspend a transfer of data if they deem that the transfer violates EU citizens' privacy rights, regardless of any assessment made by the European Commission when agreeing to a data-transfer pact with that country.

The court said the Irish supervisory authority is therefore required to investigate the claims brought by the plaintiff Max Schrems, an Austrian privacy activist, over the transfer of data by Facebook.

The European Commission is slated to hold a news conference in the afternoon in response to the court ruling.

Write to Natalia Drozdiak at natalia.drozdiak@wsj.com

Access Investor Kit for "Apple, Inc."

Visit http://www.companyspotlight.com/partner?cp_code=P479&isin=US0378331005

Subscribe to WSJ: http://online.wsj.com?mod=djnwires

(END) Dow Jones Newswires

October 06, 2015 05:35 ET (09:35 GMT)

Copyright (c) 2015 Dow Jones & Company, Inc.