The Data Protection Commission has said it "strongly welcomes" a European Union Court of Justice judgment on an EU-US data transfer agreement.
The court has found that the agreement, known as Privacy Shield, is invalid.
The long running case follows concerns regarding the transfer of data from Facebook users in Europe, where protection is in place under GDPR, to the United States.
The Data Protection Commission (DPC) said the judgment firmly endorses "the substance of the concerns expressed by the DPC (and by the Irish High Court) to the effect that EU citizens do not enjoy the level of protection demanded by EU law when their data is transferred to the United States."
Noting that the decision was made in relation to the case taken by Austrian privacy activist Max Schrems, the commission added: "It is of course the case that its scope extends far beyond that, addressing the position of EU citizens generally."
Mr Schrems took the case in Ireland as this is where Facebook's EU headquarters are based.
File photo dated of the Facebook logo. Picture by: Dominic Lipinski/PA Wire/PA ImagesThe court also agreed with the Data Protection Commission's view that, whatever mechanism is used to transfer data to a third country, the protection given to EU citizens in respect of that data "must be essentially equivalent to that which it enjoys within the EU."
It said the judgment will require careful consideration in the coming days and weeks.
"While in terms of the points of principle in play, the court has endorsed the DPC’s position, it has also ruled that the SCCs [Standard Contractual Clauses] transfer mechanism used to transfer data to countries worldwide is, in principle, valid, although it is clear that, in practice, the application of the SCCs transfer mechanism to transfers of personal data to the United States is now questionable," the commission said.
The US Secretary of Commerce Wilbur Ross said: "While the Department of Commerce is deeply disappointed that the court appears to have invalidated the European Commission’s adequacy decision underlying the EU-US Privacy Shield, we are still studying the decision to fully understand its practical impacts.
"We have been and will remain in close contact with the European Commission and European Data Protection Board on this matter and hope to be able to limit the negative consequences to the US$7.1tn transatlantic economic relationship that is so vital to our respective citizens, companies and governments.
"Data flows are essential not just to tech companies, but to businesses of all sizes in every sector.
"As our economies continue their post-COVID-19 recovery, it is critical that companies - including the 5,300+ current Privacy Shield participants - be able to transfer data without interruption, consistent with the strong protections offered by Privacy Shield."
