Luxembourg, 3 September 2025
The General Court of the European Union has dismissed a challenge against the Commission’s July 2023 adequacy decision, which established the latest framework for the transfer of personal data between the EU and the United States.
The action was brought by Philippe Latombe, a French citizen, who argued that the U.S. Data Protection Review Court (DPRC) lacked independence and that American intelligence agencies’ bulk data collection practices violated EU standards on fundamental rights.
The Court rejected both claims. It found that the DPRC operates with sufficient safeguards to ensure its independence and is shielded from improper influence. It also confirmed that U.S. signals intelligence activities are subject to meaningful ex post judicial review, satisfying the requirements set out in Schrems II.
The judges underlined that the European Commission must continuously monitor the application of the framework and retains the power to suspend, amend, or repeal the adequacy decision if U.S. law no longer ensures an adequate level of protection.
By dismissing the case, the Court confirmed that, at the time of adoption, the United States provided a level of data protection “essentially equivalent” to that guaranteed under EU law, thus allowing transatlantic data flows to continue under the new framework.
Legal consequences of the General Court’s judgment
1. Preservation of legal certainty for transatlantic data transfers
By upholding the European Commission’s July 2023 adequacy decision—the EU–US Data Privacy Framework (DPF)—the General Court provides much-needed stability. This decision confirms the continued lawful basis for thousands of EU and U.S. organizations to transfer personal data without additional legal safeguards.
2. Validation of “essential equivalence” standard
The Court reaffirmed that the United States, as of the adoption of the adequacy decision, offered an “adequate level of protection”—i.e., a level materially equivalent to that required under EU law—despite not being identical.
3. Acknowledgement of DPRC’s Independence and Impartiality
The Data Protection Review Court (DPRC), a redress mechanism established under Executive Order 14086 and Attorney General regulations, was found to be sufficiently independent. Judges enjoy procedural safeguards; dismissal occurs only for cause, and the executive branch is barred from inappropriate influence.
4. Legitimacy of bulk data collection with ex post review
Contrary to the challenge, the Court held that prior judicial authorization is not a strict requirement under Schrems II. What matters is the availability of effective ex post judicial oversight, which the DPRC provides.
5. Commission’s ongoing supervision obligations
The European Commission is mandated to continuously monitor the DPF’s application. If future developments in U.S. law compromise the protection level, the Commission has authority to suspend, amend, restrict, or rescind the adequacy decision.
6. Scope for appeal to the CJEU remains open
Mr. Latombe may appeal the General Court’s ruling to the Court of Justice of the European Union (CJEU) on points of law within a two-month and ten-day period. An appeal could reposition the outcome, as past precedents (Schrems I, Schrems II) illustrate the CJEU’s more stringent interpretations.
7. Business and regulatory impacts
- Enterprises benefit: The judgment safeguards the legal basis for ongoing data transfers essential to operations across industries (banking, tech, pharmaceuticals, automotive, etc.).
- Continued compliance requirements: Organizations must still fulfill GDPR-related obligations—transparency, minimal data transfer scope, contractual protections, and certification status under the DPF.
8. Broader implications for parallel frameworks
The ruling also reinforces parallel data-transfer mechanisms like the Swiss–U.S. DPF and the U.K.’s mirroring scheme, as these frameworks are modeled closely on the EU–U.S. arrangement.
9. Civil society’s dissenting perspectives
Privacy groups, including NOYB and Max Schrems, criticized the judgment as overly narrow and not reflective of deeper structural issues, particularly with respect to executive authority and mechanisms established by order rather than law.