The European Court of Justice on Thursday struck down a data sharing arrangement between the European Union (EU) and the United States, arguing that it has failed to offer enough privacy protection for Europeans against U.S. surveillance.

"The Court of Justice invalidates Decision 2016/1250 on the adequacy of the protection provided by the EU-U.S. Data Protection Shield," the EU's top court said in a press release.

The court found that in the current arrangement of data transfer, "the requirements of U.S. national security, public interest and law enforcement have primacy, thus condoning interference with the fundamental rights of persons whose data are transferred to that third country."

After whistleblowing from U.S. National Security Agency contractor Edward Snowden, who revealed in 2013 that the U.S. government was spying on online data including European data from Facebook users, Maximillian Schrems, an Austrian activist, sought to stop data transfer from Ireland, where Facebook's EU operations are legally headquartered, to the United States.

Schrems argued that "the law and practices in the United States do not offer sufficient protection against access by the public authorities to the data transferred to that country," according to the court's decision on Thursday, and his case ultimately landed in the EU's top court based in Luxembourg.

The EU law provides that the transfer of data to a third country may, in principle, take place only if the third country in question ensures an adequate level of data protection.

On July 12, 2016, the European Commission adopted the adequacy decision on the EU-U.S. Privacy Shield, and the Privacy Shield framework became operational in August the same year.