By Sam Schechner 

One of the last legal methods that companies have to store Europeans' data -- everything from Swedish salary files to Spanish selfies -- on servers in the U.S. was thrust deeper into limbo Wednesday when a privacy regulator said it would ask Europe's top court to review its legality.

The Irish Data Protection Commissioner's office said it plans to ask the European Union's Court of Justice to review backup contractual language that Facebook Inc. and thousands of other companies use to justify sending personal information about Europeans to the United States. The same court last year invalidated the main legal framework the companies had used to do so.

The referral puts new pressure on firms that operate in the EU and keep data about customers or employees on servers on U.S. soil. Companies ranging from cloud services to retail have been scrambling to avoid running afoul of European privacy law since the EU court last year ruled that the 15-year-old data-transfer agreement dubbed Safe Harbor was invalid because it could expose Europeans to mass surveillance by the U.S. government.

Wednesday's announcement also raises the pressure on the EU's executive arm, which has faced opposition as it rushes to complete a successor agreement to Safe Harbor to keep data flowing. In an opinion last month, a body representing the EU's 28 privacy regulators said that the new framework, dubbed Privacy Shield, needs to change to rule out any "massive and indiscriminate" collection of personal information by intelligence agencies, signaling that the new agreement will likely end up back in court as well.

At issue in the new referral is whether companies can still use snippets of contractual language that has been preapproved as privacy compliant by the EU when transferring personal data to the American servers. Following last year's court decision, many companies said they were now relying on contracts using those so-called standard contractual clauses to authorize their data transfers. Without those clauses, there are few other ways to justify keeping such data in the U.S. under EU law.

Hanging in the balance are billions of dollars in business, particularly in the online-advertising and cloud-services sectors.

"This is a worrying development for all organizations that transfer personal data from Europe," said Oliver Yaros, a lawyer at Mayer Brown. He added that if courts decide to invalidate the EU's backup mechanism without a viable alternative, "the effect on international business would be catastrophic."

The referral and last year's decision both stem from a complaint that privacy activist Max Schrems launched three years ago against Facebook in Ireland, where the company has its European headquarters. Mr. Schrems based his case on allegations by former National Security Agency contractor Edward Snowden that U.S. intelligence agencies had wide-ranging access to personal information gathered by American tech firms.

When the Irish privacy regulator rejected his claim, saying Facebook was protected by the old Safe Harbor agreement, Mr. Schrems appealed to an Irish court, which referred his claim to the EU's Court of Justice. In its decision last year invalidating Safe Harbor, the court said the Irish privacy regulator now had to evaluate the merits of Mr. Schrems's complaints. It is as part of that inquiry that the regulator said it would refer the new question back to the courts.

Facebook contends that while it is the subject of the case, its impact goes far wider.

"This isn't just an issue for Facebook," said Stephen Deadman, Facebook's global deputy chief privacy officer. "If [standard clauses] were found to be invalid it would have serious consequences for the European economy."

Write to Sam Schechner at sam.schechner@wsj.com

 

(END) Dow Jones Newswires

May 26, 2016 02:48 ET (06:48 GMT)

Copyright (c) 2016 Dow Jones & Company, Inc.
Meta Platforms (NASDAQ:META)
Historical Stock Chart
From Feb 2024 to Mar 2024 Click Here for more Meta Platforms Charts.
Meta Platforms (NASDAQ:META)
Historical Stock Chart
From Mar 2023 to Mar 2024 Click Here for more Meta Platforms Charts.