Dublin: The top European Union court was asked on Thursday to rule on whether the system used by thousands of companies such as Facebook to transfer users' data to the United States respects EU privacy law.
The referral from the Irish High Court stems from a case brought by an Austrian privacy activist against the methods used by Facebook to store user data on U.S. servers, and plunges the ability of firms to conduct everyday cross-border data transfers into legal limbo once more.
The High Court asked if the Privacy Shield - which enables firms to easily transfer Europeans' data to the United States in compliance with EU law - does in fact mean that the United States "ensures an adequate level of protection".
Paul Gallagher, a lawyer for Facebook, said the company was considering whether to appeal the referral.
Facebook is under scrutiny after it emerged the personal information of up to 87 million users, mostly in the United States, may have been improperly shared with political consultancy Cambridge Analytica.
The Privacy Shield was hammered out between the EU and the United States after the Court of Justice of the EU (ECJ) struck down its predecessor on the grounds that it did not afford Europeans' data enough protection from U.S. surveillance.
Irish High Court Judge Caroline Costello in October said she had decided to ask the ECJ for a preliminary ruling in the case but only specified the exact questions on Thursday.
Max Schrems, an Austrian law student who successfully challenged safe Harbour - Privacy Shield's predecessor - subsequently brought a case against another legal instrument used by Facebook and other firms to transfer personal data to the United States, so-called standard contractual clauses.
The High Court asked the ECJ whether personal data transferred from the EU to the United States using such clauses violated Europeans' fundamental right to privacy.
"Given the case law, the question in this case does not seem to be if Facebook can win it, but to what extent the Court of Justice will prohibit Facebook’s EU-US data transfers," Schrems said in a statement.
A ruling from the ECJ is likely to take around 18 months.