Will the EU-US Data Privacy Framework survive?
Under the GDPR, requirements are imposed regarding the extent to which legal protection equivalent to that of the GDPR is guaranteed in non-EEA countries. If this is adequate, a so-called adequacy decision may be adopted by the European Commission (EC) pursuant to Article 45 of the GDPR. With regard to the United States, adequacy decisions have been adopted on several occasions, known as Safe Harbour and Privacy Shield.
These were declared invalid by the European Court of Justice in the two Schrems cases, Schrems 1 and Schrems 2.
Schrems 1 and Schrems 2
The main reason for the invalidation was the extent to which the United States cannot guarantee independent judicial review for those who believe their rights under the GDPR have been infringed.
As data traffic between the United States and the EEA countries represents a significant economic interest, a new adequacy decision was adopted following the Schrems 2 case, namely the EU-US Data Privacy Framework. Central to this, and a key change from the previous adequacy decision, is the establishment of an independent judicial body, the Data Protection Review Court (DPRC).
The Latombe v European Commission case
On 3 September 2025, a court of first instance, the General Court (GC) of the Court of Justice of the European Union, delivered a judgment on the validity of the EU-US Data Privacy Framework.
The case was brought by a French citizen, Mr Latombe. The defendant is the European Commission. It is notable that the United States and Ireland have joined the European Commission as interveners.
Apart from the interesting question of whether a citizen in this case can go directly to the GC, rather than first awaiting the outcome of national proceedings, the independence of the DPRC is at issue in the case.
What were the arguments?
(1) The first argument is that the DPRC is not an independent and impartial tribunal, as its remit is to review decisions made by the ‘Civil Liberties Protection Officer of the Director of the National Intelligence Service’
(2) The second argument is that the DPRC is not an independent and impartial tribunal, as it consists of judges appointed by the Attorney General after consultation with the PCLOB
(3) The third argument is that the DPRC is not an independent and impartial tribunal, as the Attorney General’s order does not preclude its judges from being subject to forms of oversight other than day-to-day oversight by the executive branch
These arguments are rejected on the basis of the rules governing the establishment and functioning of the DPRC set out in President Biden’s Executive Order 14086. The case has been referred on appeal to the Court of Justice of the European Union, where, in addition to the issue of admissibility, the argument regarding the temporary nature of the Executive Order during the Trump era is likely to be raised.
To be continued!
Advice
Do you have any questions regarding this article? Our solicitors are ready to advise you! Please contact one of our solicitors via email, by telephone or fill in the contact form for a no-obligation initial consultation.
