EU regulators must block tech companies from transferring data outside the bloc in cases in which privacy rules are broken, an advisor to the European Union’s top court said Thursday, part of a lengthy legal case involving an Austrian privacy campaigner and Facebook.

The European Court of Justice’s advocate general said that so-called “standard contractual clauses” - in which businesses commit to abide by strict EU privacy standards when transferring messages, photos and other information - are adequate. Companies like Facebook routinely move such data among its servers around the world, and the clauses - stock terms and conditions - are used to ensure the EU rules are maintained when data leaves the bloc.

Activist Max Schrems, worried about Europeans facing mass U.S. surveillance, had argued the clauses mean authorities in individual EU countries can, by law, halt data transfers in specific cases if data privacy is violated.

Advocate General Henrik Saugmandsgaard Oe agreed, saying in a preliminary opinion that a provision in the clauses means companies and regulators have an obligation to suspend or prohibit transfers if there’s a conflict with the law in a third country such as the U.S.

The advocate general’s opinion is not binding but may influence the court’s judges when they issue their final ruling.

The case has potentially far-reaching implications for social media companies that move large amounts of data via the internet. Facebook’s European subsidiary regularly does so.