Facebook and other Internet giants could be barred from sending European citizens' personal information to the US after the EU's top court on Tuesday struck down a key transatlantic data deal in the wake of the Edward Snowden scandal.
The landmark verdict stemmed from a case lodged by Austrian law student Max Schrems, who challenged the 2000 "Safe Harbour" agreement between Washington and Brussels on the grounds it did not properly protect European data.
After declaring Safe Harbour "invalid," the European Court of Justice said authorities in Ireland, where Facebook has its European HQ and where Schrems lodged the case, now had to decide whether transfers of data to Facebook in the United States should be suspended outright.
"The message is clear -- mass surveillance is not possible in Europe (and is) against fundamental rights," Schrems, who turns 28 this month, told reporters at the court building in Luxembourg.
Snowden -- the former National Security Agency whistleblower who in 2013 revealed a worldwide US surveillance programme harvesting the data -- said Schrems had "changed the world for the better."
"Europe's high court just struck down a major law routinely abused for surveillance," Snowden wrote on Twitter.
But Washington said it was "deeply disappointed" in the decision.
The ruling "creates significant uncertainty for both US and EU companies and consumers, and puts at risk the thriving transatlantic digital economy," said Secretary of Commerce Penny Pritzker.
Thousands of companies ranging from Google and Amazon to smaller businesses rely on Safe Harbour to transfer to data storage servers based elsewhere huge amounts of information collected from users: personal data, their searches, preferences and purchases.
Facebook called for Washington and Brussels to sort out the situation urgently, insisting the case was "not about Facebook" and that it had done nothing wrong.
"It is imperative that EU and US governments ensure that they continue to provide reliable methods for lawful data transfers and resolve any issues relating to national security," a Facebook spokeswoman said in an emailed statement to AFP.
The EU said it had started negotiating a new Safe Harbour arrangement with the US before the verdict, and said that firms could keep sending personal information across the Atlantic in the meantime.
"We have already been working with the American authorities to make data transfers safer for European citizens. In the light of the ruling, we will continue this work towards a renewed and safe framework," European Commission Vice President Frans Timmermans said.
Schrems was jubilant after the decision, saying the verdict was a "major blow for US global surveillance that heavily relies on private partners."
The Austrian had argued that the 15-year-old Safe Harbour deal was too weak to guarantee the privacy of European residents following Snowden's revelations.
He filed the case in Ireland where Facebook's European headquarters are based, but it was originally rejected and then passed to the ECJ.
The Irish authorities now have to decide whether transfers of Facebook subscriber data to the United States should be suspended "on the ground that that country does not afford an adequate level of protection of personal data," the court said after ruling on the case.
Ireland's data protection commissioner said the issue would be considered by the country's high court "as soon as is practicable".
The ruling has set up another clash over privacy rights between the United States and Europe, two years after the Snowden revelations of mass spying first caused alarm in Brussels.
Germany welcomed the EU judgment, no surprise in a country where relations with Washington were badly strained when Snowden revealed the alleged tapping of Merkel's mobile phone by US snoopers.
Germany's justice minister, Heiko Maas, said the ruling was a "strong signal for fundamental rights protection in Europe," adding that "those who offer products or services in the EU must adhere to EU data protection rights -- no matter where the server is."
Pritzker insisted however that Safe Harbour "has proven to be critical to protecting privacy on both sides of the Atlantic and to supporting economic growth in the United States and the EU."
Referring to the work already well underway to update the agreement, she said "We are prepared to work with the European Commission to address uncertainty created by the court decision."