The EU General Court upholds the Data Privacy Framework in the Latombe case

2025-09-03 · Publisher : Tribunal de l'Union européenne · Domain : Cloud & DevOps

In the Latombe judgment (T-553/23), the General Court dismisses the challenge against the adequacy decision on the EU-US Data Privacy Framework. The framework remains valid, but an appeal to the Court of Justice is possible.

### What changes On 3 September 2025, the General Court of the European Union dismisses, in **Latombe v Commission (T-553/23)**, the action for annulment of the Commission's adequacy decision on the EU-US **Data Privacy Framework (DPF)**. Philippe Latombe, a French member of parliament, challenged in particular the independence of the US data protection review court and bulk data collection by US intelligence services. ### Key facts - The Court finds that the Data Protection Review Court (DPRC) offers sufficient safeguards of independence, notably against interference by the executive. - It holds that the Schrems II judgment does not require bulk collection to be subject to prior authorization: ex post judicial oversight is enough. - It recalls that the legality of an EU act is assessed at the time of its adoption (2023) and does not take later developments into account. - The judgment can be appealed to the Court of Justice within two months and ten days, limited to points of law. - This is the third time in ten years that an EU-US data transfer mechanism has been examined by the Union's highest courts, after the invalidation of Safe Harbor (2015) and Privacy Shield (2020). ### Why it matters For CIOs and IT services firms, the decision secures, in the short term, transfers to US providers certified under the DPF, and therefore the use of US cloud services. But it settles neither the risk of a new challenge, nor the reach of the Cloud Act, nor US developments after 2023. Standard contractual clauses remain a safety net to keep. ### Takeaway The DPF survives in 2025, but only on the basis of the 2023 situation: the contractual plan B remains necessary.

Tags : États-Unis, Europe, Données, Réglementation, Souveraineté