Facebook is starting to feel the heat in Europe.
The social network, and other big U.S. tech companies, might soon be forced to rethink the way they deal with user data in Europe.
The European Union’s top court issued a strong opinion Wednesday suggesting that Facebook and others can’t simply hand over data to U.S. authorities.
Under an agreement reached in 2000 between the U.S. and Europe, tech firms were allowed to transfer users’ data in huge quantities to their servers in the U.S.
But the advocate general at the European Court of Justice believes that the deal is no longer valid in the light of allegations of mass spying by the U.S. intelligence services. It said individual countries should have the right to ban U.S. companies from transferring data in the future.
The court said the easy access to the data by the U.S. authorities “constitutes an interference with the right to respect for private life and the right to protection of personal data.” It also said that U.S. intelligence services were carrying out “mass, indiscriminate surveillance.”
The case against Facebook was brought forward by Austrian law student Max Schrems. He said he was uncomfortable with the way Facebook transfers his personal data to the U.S., where it can be accessed by authorities with little respect for his privacy. He used documents exposed by the Wikileaks whistleblower Edward Snowden to illustrate the problem.
“This finding, if confirmed by the court, would be a major step in limiting the legal options for U.S. authorities to conduct mass surveillance on data held by EU companies, including EU subsidiaries of U.S. companies,” Schrems said in a statement.
Facebook said it operates “in compliance with EU Data Protection law.”
“Like the thousands of other companies who operate data transfers across the Atlantic we await the full judgment,” a Facebook spokesperson said.
A final ruling is expected later this year. In the majority of cases at the European court, the verdict is consistent with the opinion of the advocate general.
“The opinion on U.S. surveillance is very strong,” Paul Bernal, data protection expert and a law lecturer at University of East Anglia, said.
“To say strongly and clearly that US surveillance is ‘mass, indiscriminate surveillance’ is very direct,” he added.
The case could cause headaches for other big U.S. companies operating in Europe. Around 4,000 companies use the current rules to transfer data.
Other big tech companies, such as Google, Amazon, and Twitter, are already under the scrutiny of the European Union over antitrust and privacy concerns.