The European Union’s (EU) highest court gave their opinion on a security matter concerning Facebook handing over user data of EU citizens to United States officials. The opinion of the European Court of Justice ruled that the data sharing rules between Europe and the U.S. were “invalid.”

An agreement was reached in 2000 between Europe and the U.S. allowing tech firms to transfer user data in huge quantities to U.S. servers. However, the court believes the deal is no longer valid due to recent allegations of mass spying by U.S. intelligence agencies.

The case was brought forward by activist and Austrian law student Max Schrems. Schrems was concerned with how his personal data could be transferred to the U.S. through Facebook. To illustrate the problem, he used documents leaked by Edward Snowden.

“This finding, if confirmed by the court, would be a major step in limiting the legal options for U.S. authorities to conduct mass surveillance on data held by EU companies, including EU subsidiaries of U.S. companies,” Schrems said in a statement.

A final ruling is expected later this year. If ruled in favor of Schrems, Facebook’s European branch in Ireland “would be barred from processing its data in the U.S., but would have to process its data in a place where those data are not subject to NSA mass-surveillance,” Herwig Hofmann, a lawyer representing Schrems, told reporters.

Facebook continues to state that have broken no laws and are in complete compliance with the EU Data Protection Law.

“We have repeatedly said that we do not provide ‘backdoor’ access to Facebook servers and data to intelligence agencies or governments,” said Facebook spokeswoman Sally Aldous.

The case is: C-362/14, Maximillian Schrems v. Data Protection Commissioner.