The European Union's highest court ruled Tuesday in favour of an Austrian law student who claims a trans-Atlantic data protection agreement doesn't adequately protect consumers.