The ruling was made on Tuesday after the ECJ heard claims the provision, which is relied on by 4,400 companies to carry data across the Atlantic, had exposed EU citizens to illicit surveillance by the National Security Agency. Internet and IT giants such as Amazon, Facebook and IBM have since scrambled to change the legal footing of their businesses to avoid breaking the law.

‘Jeopardises vital data flows’

Chris Padilla, IBM’s vice-president of government and regulatory affairs, said the decision ‘jeopardises these vital data flows’ and would harm Europe’s plan for a digital single market.

Penny Pritzker, US commerce secretary, said Washington was ‘deeply disappointed’ by the ruling, which would create ‘uncertainty for both US and EU companies and consumers, and puts at risk the thriving transatlantic digital economy’.

‘Milestone for online privacy’

The case originated from a 2014 complaint against Facebook by Max Schrems, an Austrian law student. He described the ruling as a ‘milestone when it comes to online privacy.’ Source: Financial Times