BRUSSELS/LUXEMBOURG, Oct 6 – A system enabling data transfers from the European Union to the United States by thousands of companies is invalid, the highest European Union court said on Tuesday in a landmark ruling that will leave firms scrambling to find alternative measures.

“The Court of Justice declares that the Commission’s U.S. Safe Harbour Decision is invalid,” it said in a statement.

The decision could sound the death knell for the Safe Harbour framework set up fifteen years ago to help companies on both sides of the Atlantic conduct everyday business but which has come under heavy fire following 2013 revelations of mass U.S. snooping.

Without Safe Harbour, personal data transfers are forbidden, or only allowed via costlier and more time-consuming means, under EU laws that prohibit data-sharing with countries deemed to have lower privacy standards, of which the United States is one.

The Court of Justice of the European Union (ECJ) said that U.S. companies are “bound to disregard, without limitation,” the privacy safeguards provided in Safe Harbour where they come into conflict with the national security, public interest and law enforcement requirements of the United States.

Revelations by former National Security Agency contractor Edward Snowden of the so-called Prism programme allowing U.S. authorities to harvest private information directly from big tech companies such as Apple, Facebook and Google prompted an Austrian law student Max Schrems (pictured above) to try to halt data transfers to the United States.

Schrems challenged Facebook’s transfers of European users’ data to its U.S. servers because of the risk of U.S. snooping. As Facebook has its European headquarters in Ireland, he filed his complaint to the Irish Data Protection Commissioner.

The case eventually wound its way up to the Luxembourg-based ECJ, which was asked to rule on whether national data privacy watchdogs could unilaterally suspend the Safe Harbour framework if they had concerns about U.S. privacy safeguards.

In declaring the data transfer deal invalid, the Court said the Irish data protection authority had to the power to investigate Schrems’ complaint and subsequently decide whether to suspend Facebook’s data transfers to the United States.

“This is extremely bad news for EU-U.S. trade,” said Richard Cumbley, Global Head of technology, media and telecommunications at law firm Linklaters. “Without Safe Harbor, (businesses) will be scrambling to put replacement measures in place.”

(by Julia Fioretti and Michele Sinner; editing by Barbara Lewis)