Appeal Seeking Annulment Of The Data Privacy Framework Dismissed

In a ruling dated September 3, 2025 ¹ , the General Court of the European Union ("GCEU") dismissed the appeal brought by the French member of parliament Philippe Latombe, seeking annulment of the "Data Privacy Framework" established by the European Commission's adequacy decision of July 10, 2023, allowing the transfer of personal data from the European Union to the United States.

As a reminder, previous adequacy decisions allowing data transfers between the European Union and the United States had been annulled by the Court of Justice in the "Schrems I" and "Schrems II" judgments.

In support of his application, Mr. Latombe considered, in particular, that :

• the "Data Protection Review Court" (Court responsible for data protection oversight in the United States ("DPRC")) was neither impartial nor independent ;
• the collection by US intelligence agencies of personal data in transit from the European Union, without prior authorization from a judge or independent administrative authority, was illegal as it was not governed by sufficiently clear and precise rules.

In this case, the GCEU considered, in particular, that the appointment of DPRC judges and the functioning of that institution are subject to safeguards and conditions that ensure the independence of its members and that the Attorney General and intelligence agencies cannot unduly interfere with or influence the work of the DPRC. Therefore, the argument raised by Mr. Latombe had to be rejected.

On the other hand, the TUE notes that nothing in the Schrems II judgment provides that bulk collection of personal data "must be subject to prior authorization by an independent authority." However, "such collection must at least be subject to ex post judicial review." ². Furthermore, the GCEU specifies that electromagnetic intelligence activities carried out by US intelligence agencies, including when they collect personal data in bulk, are subject to ex post judicial oversight by the DPRC. Therefore, the GCEU considers that the bulk collection of personal data is carried out in accordance with the requirements of the Schrems II judgment.

In view of these factors, among others, the GCEU dismissed the action for annulment brought by Mr. Latombe. This ruling by the GCEU may, however, be appealed before the Court of Justice of the European Union. Furthermore, the Commission retains the possibility, in the event of a change in the legal framework on which the contested adequacy decision is based, to suspend, amend or repeal the contested decision or to restrict its scope.

Footnotes

1 Judgment GCEU case T-553/23

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.