Facebook Inc. should not be sending European data to the United States, Ireland’s Data Protection Commission announced Wednesday.

A recent inquiry has led regulators to believe that the transfer of such data does not protect users from U.S. government surveillance. If Facebook is deemed to be breaking European data protection laws, it could be fined 4% of its global revenue – enough to force Facebook to make big changes to its operations. The order is only preliminary, and Facebook has until the end of the month to address the complaint.

The company had been transferring data under a legal framework called “Privacy Shield,” which was invalidated in July by the Court of Justice of the European Union. It was deemed that this agreement wasn’t satisfactory, and Europeans’ privacy was not adequately protected.

In a blog post published today, Nick Clegg, Facebook’s vice president of global affairs and communications and Britain’s former deputy prime minister, said there was still an alternative way to transfer data under what are called “Standard Contractual Clauses” and that agreement is still valid.

Nonetheless, the inquiry by the Irish Data Protection Commission into Facebook-controlled E.U.-U.S. data transfers has ruled that such clauses don’t offer enough protection to the consumer. That’s why the invalidation of Privacy Shield has caused such a stir and could have a major impact on many companies.

“The rationale in invalidating Privacy Shield has nonetheless created significant uncertainty – not just for U.S. tech companies, or even for all the European businesses who rely on online services to reach new customers, but for all European businesses with transatlantic data flows,” said Clegg. More than 5,000 companies rely on Privacy Shield to do their business.

Clegg went on to say that if these avenues of data transfers are closed it will damage the European economy in a profound way. “In the worst-case scenario, this could mean that a small tech start up in Germany would no longer be able to use a U.S.-based cloud provider,” he said. “A Spanish product development company could no longer be able to run an operation across multiple time zones. A French retailer may find they can no longer maintain a call center in Morocco.”

Facebook won’t be the only tech behemoth concerned about the recent decision. Companies such as Google Inc. and Amazon.com Inc. will also be watching how this unfolds.

Photo: ThoughtCatalog/Flickr