A decision Tuesday by Ireland’s High Court in the case brought by Austrian privacy activist Max Schrems has cast new uncertainty on the legal tool that Facebook and thousands of other U.S. companies use to transfer personal data from their operations in the European Union.

Irish High Court Justice Caroline Costello in a highly anticipated ruling said the Irish Data Protection Commissioner had raised “well-founded concerns” about whether U.S. surveillance practices deny EU citizens fundamental rights once their data is transferred to the U.S.