I don't think you've been keeping up with the case. There is no new legislation, but a very simple point in contention. Did the Safe Harbour provision, intended to ensure corporations met European levels of data control, cover state intelligence gathering. The ruling is at this point, no. The Irish Data Protection Commissioner had stated in relation to the European Data Protection Directive that they had no power to look at the scope of Safe Harbour and that in of itself Facebook met the requirements of Safe Harbour.
It is not news that the NSA etc. did not see themselves as constrained by Safe Harbour. In light of the ECJ's rulings an investigation into Facebook's protection of European data seems appropriate.