Privacy & Cybersecurity Law Blog

On September 3, 2025, the EU’s General Court (“GC”) issued its judgment in the Latombe v. Commission case (the “Judgment”). The applicant, a member of the French National Assembly, sought the annulment of the adequacy decision adopted by the European Commission with respect to the EU-U.S. Data Privacy Framework. Many companies currently rely on the EU-U.S. Data Privacy Framework to legitimize their transatlantic data flows, meaning an annulment of the adequacy decision would have had a significant impact.

The applicant argued that (1) the Data Protection Review Court (“DPRC”), which is a key component of the redress mechanism offered to EU citizens with respect to U.S. intelligence activities, should not be considered independent; and (2) the lack of prior authorization from a court or independent administrative authority for U.S. intelligence personal data collection activities is not compatible with its adequacy status.

While there were expectations that the GC may consider that the applicant did not have standing to bring these proceedings, the GC explicitly decided to not analyze this matter and, instead, dismissed the action brought before it on its merits.

In its Judgment, the GC dismisses the argument that the DPRC is not independent on the basis that (1) the appointment of judges to the DPRC and the DPRC’s functioning are accompanied by several safeguards; (2) judges of the DPRC may be dismissed only by the Attorney General and only for cause; (3) the Attorney General and intelligence agencies may not hinder or improperly influence their work; and (4) the EU Commission is required to monitor the U.S. legal framework and act if necessary (e.g., by suspending the adequacy decision).

Regarding the bulk collection of personal data for intelligence purposes, the GC takes the view that the Schrems II judgment does not require these activities to be subject to prior authorization. Since personal data collection is subject to ex post judicial oversight by the DPRC, the GC considers that the U.S. meets a sufficient standard for its level of protection to be considered essentially equivalent to that provided in the EU.

The GC’s decision may be appealed to the Court of Justice.

Read the judgment (only available in French).