By Sam Schechner and Valentina Pop 

LUXEMBOURG--In a gold-curtained courtroom here, a debate is playing out over the transfer of personal data used for billions of dollars in digital advertising.

The European Court of Justice--the European Union's top court--heard arguments Tuesday in the biggest threat yet to a legal mechanism that allows Facebook Inc. and thousands of other firms to transfer European personal data to U.S.-based servers.

Following revelations of widespread surveillance by the U.S. National Security Agency, plaintiff Max Schrems, an Austrian law student, made the case that the EU-U.S. agreement, called Safe Harbor, no longer guarantees the privacy of European residents. He was supported by lawyers representing the governments of Belgium, Poland and Austria.

"Mass surveillance is manifestly incompatible with the fundamental right to privacy and data protection," Noel Travers, a lawyer for Mr. Schrems, told the court on Tuesday.

Mr. Travers acknowledged that he has "no evidence of the NSA specifically having accessed my client's data" but said that Mr. Schrems's right to privacy was violated and that in itself can be considered harmful.

The case is a surprise challenge in a wave of disputes between the EU and U.S. over online privacy. European officials look at the protection of personal data as a fundamental right on par with free expression; the U.S. regulates privacy mostly as a consumer-protection issue. That divide was further highlighted last year when the same court decided that a "right to be forgotten" applies to search engines like Google Inc.

At stake in the case is traffic in a major currency of the trans-Atlantic economy: personal information. For companies that offer ad-supported services, personal information--like the location of a Web user--allows the sale of targeted advertisements. Digital ad spending in Western Europe is expected to total $34.81 billion in Europe in 2015, up 8.5% from last year, according to research firm eMarketer.

In the U.K. alone, three American firms--Google, Facebook and Twitter Inc.--will account for more than half of the overall digital ad spending of GBP8.06 billion (about $12 billion) in 2015, eMarketer says.

Safe Harbor was a stopgap deal adopted in 2000 after the EU found that the U.S.'s patchwork of different data-protection regimes wasn't stringent enough to meet European standards. Under the agreement, the EU let data flows continue for companies that self-certify they are in line with EU-data protection rules.

Mr. Schrems challenged Facebook's compliance with EU data-privacy rules in Ireland, where the company's European operations are based. The Irish data protection authority rejected Mr. Schrems's challenge, a move that he appealed in the country's highest court, which asked the EU's top court whether national authorities can suspend Safe Harbor when there are "extraordinary circumstances."

Facebook declined to comment on the case, but says that it provides user data to governments only when laws force it to do so.

Safe Harbor's defenders--including the European Commission, the EU's executive arm--respond that the question of how to protect Europeans from overzealous spying is already part of talks between the EU and the U.S. to address European concerns about the agreement. They say any move by the court to scrap it now would upset trans-Atlantic ties.

"It would have quite serious effects...risking disruption of trade that carries significant benefit for the EU and its citizens," said a representative of the U.K. government at Tuesday's hearing.

Several EU countries--Belgium, Austria, Poland--lined up to support Mr. Schrems on Tuesday. "Safe Harbor is not in fact for the data of EU citizens, but is at best a safe harbor for data pirates," Gerhard Kunnert, a lawyer representing the Austrian government, told the court.

The lead judge on the case, Thomas von Danwitz, also appeared sympathetic. He grilled the lawyer for the European Commission on the language used in the Safe Harbor text, which the lawyer admitted is "no model of clarity."

Mr. von Danwitz was also the lead judge when the court last year struck down a data-retention law obliging telecom companies to store the data of Europeans for law enforcement.

Companies on both sides of the Atlantic have expressed concern at the possible scrapping of Safe Harbor, because it concerns not just advertising but also things like payroll information and company phone books. European firms like Ericsson and BT Group PLC often rely on U.S. service providers or have U.S.-based subsidiaries that are Safe Harbor-certified. There are other mechanisms to transfer data between the EU and the U.S., but they are costly because they involve contractual changes and lengthy approvals.

"If Safe Harbor is really compromised, then this creates a serious legal vacuum," said Eduardo Ustaran, a privacy attorney who works for several U.S. tech firms. "It would disrupt not just data flows, but trade relations between Europe and the U.S."

Some companies say they may be forced to build more servers in Europe if the agreement is scrapped or scaled back. Twitter said in a securities filing earlier this month that revocation of Safe Harbor could require "duplicative, and potentially expensive, information technology infrastructure and business operations in Europe."

"Without formulating an alternative this would be a major blow to the trans-Atlantic digital economy," said Thomas Boué of the Software Alliance, an umbrella lobby group for the software industry.

Mr. Schrems, for his part, dismisses those concerns. "Safe Harbor was always broken but after the [Edward] Snowden revelations, even the European Commission admits it needs improvement," he said.

A nonbinding opinion by the court's advocate general will be published on June 24, with a final verdict expected before October.

Write to Sam Schechner at sam.schechner@wsj.com and Valentina Pop at valentina.pop@wsj.com

Access Investor Kit for BT Group Plc

Visit http://www.companyspotlight.com/partner?cp_code=P479&isin=GB0030913577

Access Investor Kit for LM Ericsson Telefon AB

Visit http://www.companyspotlight.com/partner?cp_code=P479&isin=SE0000108656

Access Investor Kit for BT Group Plc

Visit http://www.companyspotlight.com/partner?cp_code=P479&isin=US05577E1010

Access Investor Kit for LM Ericsson Telefon AB

Visit http://www.companyspotlight.com/partner?cp_code=P479&isin=US2948216088

Access Investor Kit for Facebook, Inc.

Visit http://www.companyspotlight.com/partner?cp_code=P479&isin=US30303M1027

Access Investor Kit for Google, Inc.

Visit http://www.companyspotlight.com/partner?cp_code=P479&isin=US38259P5089

Access Investor Kit for Google, Inc.

Visit http://www.companyspotlight.com/partner?cp_code=P479&isin=US38259P7069

Subscribe to WSJ: http://online.wsj.com?mod=djnwires

Alphabet (NASDAQ:GOOG)
Historical Stock Chart
From Feb 2024 to Mar 2024 Click Here for more Alphabet Charts.
Alphabet (NASDAQ:GOOG)
Historical Stock Chart
From Mar 2023 to Mar 2024 Click Here for more Alphabet Charts.