On September 3rd, 2025, the EU General Court released its decision affirming the EU-US Data Privacy Framework (DPF) in the Latombe case. A member of the French parliament, Philip Latombe, brought an action to the General Court seeking to annul the DPF arguing that it violated the EU Charter of Fundamental Rights and General Data Protection Regulation. The General Court decided to hear the case despite a challenge from the European Commission (EC), arguing that Latombe lacked standing to bring the case because he had no legal interest.
This judgment comes after a long history of regulatory and executive actions from the United States (US) and the European Union (EU). After the Court of Justice of the European Union (CJEU) invalidated the Privacy Shield in Schrems II, the Biden administration issued Executive Order 14086 (EO 14086) in October 2022. This EO sought to address the issues raised in the Schrems II decision. Notably, it created a two-level redress mechanism that: (1) allows individuals from qualifying states to submit complaints to the Civil Liberties Protection Officer (CLPO) of the Office of Director of National Intelligence (ODNI) through the appropriate public authority in their state and (2) permits CLPO decisions to be appealed to the Data Protection Review Court. The Department of Justice released regulations giving legal effect to the DPRC and the ODNI published Intelligence Community Directives establishing the complaint process. EO 14086 also created policies and procedures for conducting SIGINT activities. On July 10, 2023, the EC adopted its adequacy decision for the DPF, affirming that the framework provides an adequate level of data protection for personal data to be transferred from the EU to the US.
It is important to keep in mind the CJEU’s structure when considering the significance of this ruling. The Latombe case was heard by a panel of five judges (the Tenth Chamber, Extended Composition) in the CJEU’s General Court. The General Court is part of the CJEU, along with the Court of Justice (ECJ). These are distinct judicial bodies with different compositions, jurisdictions, and procedures.
- Among other things, the General Court adjudicates direct actions by private parties, such as the one brought by M. Latombe.
- The ECJ’s remit includes hearing appeals from General Court decisions. If M. Latombe chooses to appeal the General Court’s judgment, he must do so within two months. The ECJ’s appeal process is limited to reviewing points of law.
- The ECJ also rules on EU legal questions referred to it by EU member state courts. It was the ECJ that issued the Schrems I and II opinions.
- The General Court is composed of two judges from each Member States, while the ECJ has one judge from each Member State.
Reflecting on yesterday’s decision, it seems that the DPF is safe for now, but if M. Latombe chooses to appeal, its fate will be determined by the ECJ.