In a surprise decision that will have a major impact on trans-Atlantic data transfers, Europe’s top court ruled Thursday that a mechanism used by thousands of companies to send data to the United States is unlawful, citing concerns raised by privacy activist Max Schrems in his ongoing legal battle with Facebook over whether EU citizens’ data can be shared with U.S. authorities under the country’s surveillance laws.

Neil Hodge is a freelance business journalist and photographer based in Nottingham, United Kingdom. He writes on insurance and risk management, corporate governance, internal audit, compliance, and legal...