{"id":605819,"date":"2025-12-01T18:57:17","date_gmt":"2025-12-01T18:57:17","guid":{"rendered":"https:\/\/www.europesays.com\/uk\/605819\/"},"modified":"2025-12-01T18:57:17","modified_gmt":"2025-12-01T18:57:17","slug":"european-court-of-justice-to-review-challenge-to-eu-u-s-data-privacy-framework","status":"publish","type":"post","link":"https:\/\/www.europesays.com\/uk\/605819\/","title":{"rendered":"European Court of Justice to Review Challenge to EU-U.S. Data Privacy Framework"},"content":{"rendered":"

<\/p>\n

Cross-border data flows between the European Union (EU) and the United States have long been a point of legal and political contention, and the legal frameworks governing those flows have been repeatedly tested in the EU\u2019s highest courts. The European Court of Justice, in particular, has already invalidated two prior frameworks for transatlantic data transfers\u2014the Safe Harbor in 2015 (in the court\u2019s Schrems I decision) and the Privacy Shield in 2020 (in the court\u2019s Schrems II decision)\u2014on the grounds that U.S. surveillance practices failed to meet EU standards for privacy and redress.<\/p>\n

While the third framework\u2014the EU-U.S. Data Privacy Framework (DPF)\u2014survived its first courtroom test in September 2025, the European Court of Justice may soon weigh in again following French politician Philippe Latombe\u2019s appeal on October 31, 2025. The European Court of Justice\u2019s resolution of the case could have major implications for companies that rely on the European Commission\u2019s adequacy decision regarding the DPF to enable transfers of personal data from the European Union to the United States.<\/p>\n

On September 3, 2025, the General Court of the European Union (the EU\u2019s court of first instance) dismissed a challenge brought by Latombe, a Member of the French Parliament, and confirmed the validity of the European Commission\u2019s 2023 \u201cadequacy\u201d decision upholding the DPF. The EU General Data Protection Regulation (GDPR) empowers the European Commission to issue such \u201cadequacy\u201d decisions to permit data to be transferred from the EU to a non-European country without additional safeguards such as standard contractual terms or binding corporate rules.<\/p>\n

Latombe\u2019s challenge made three core claims:<\/p>\n

    \n
  1. Lack of Independent Redress: Latombe argued that the U.S. Data Protection Review Court (DPRC), an administrative body established by President Biden\u2019s Executive Order 14086 to provide certain forms of redress for EU individuals, lacks independence and impartiality.<\/li>\n
  2. Overbroad Surveillance: Latombe also claimed that the DPF does not adequately prevent the bulk collection of data and that such collection violates Europeans\u2019 fundamental rights.<\/li>\n
  3. Insufficient Protections: Latombe further argued that U.S. law does not provide protections equivalent to those of EU law for data security and automated decision-making.<\/li>\n<\/ol>\n

    The General Court rejected each of Latombe\u2019s arguments. It found the DPRC was a sufficiently independent and impartial tribunal, that U.S. law sufficiently limited bulk data collection, and that protections around data security and automated decision-making were substantially equivalent to those in the EU.<\/p>\n

    Importantly, the General Court emphasized that its review was limited to the legal and factual context at the time of the European Commission\u2019s adequacy decision in July 2023 and pointed to key structural elements that contributed to the finding of adequacy. For example, the General Court referenced the independence of oversight bodies like the U.S. Privacy and Civil Liberties Oversight Board, which was created by statute as a part of the executive branch and, of greatest relevance here, consults with the Attorney General to appoint judges to the DPRC and reviews the redress mechanism provided by the DPRC. <\/p>\n

    However, the European Court of Justice has historically been more skeptical than the General Court in assessing U.S. surveillance practices and the adequacy of redress mechanisms. Its prior decisions in Schrems I and II invalidated frameworks that had also been endorsed by the European Commission, and Latombe\u2019s appeal puts another framework before the European Court of Justice for consideration.<\/p>\n

    For companies relying on the DPF, the European Court of Justice\u2019s impending review introduces renewed uncertainty. While the General Court\u2019s decision provides short-term reassurance, the possibility of reversal on appeal means organizations should remain vigilant, including by:<\/p>\n

      \n
    1. Monitoring developments in the appeal before the European Court of Justice and relevant regulatory changes;<\/li>\n
    2. Continuing to carefully map U.S.-bound data flows;<\/li>\n
    3. Maintaining alternative transfer mechanisms, such as standard contractual clauses; and<\/li>\n
    4. Preparing for potential shifts in U.S. surveillance policy, including but not limited to changes regarding Executive Order 14086 and FISA Section 702, that could impact European adequacy assessments.<\/li>\n<\/ol>\n

      The European Court of Justice\u2019s eventual ruling will have important implications for the future of transatlantic data transfers and digital trade at a time of heightened uncertainty.\u00a0 American trade associations and sectoral industry bodies may apply to intervene in cases before the European Court of Justice, including on appeal, in support of the European Commission to defend the Data Privacy Framework.\u00a0 WilmerHale\u2019s team of EU-based appellate lawyers stands ready to provide assistance in such matters.<\/p>\n

      <\/p>\n","protected":false},"excerpt":{"rendered":" Cross-border data flows between the European Union (EU) and the United States have long been a point…\n","protected":false},"author":2,"featured_media":282671,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5311],"tags":[49,978,659],"class_list":{"0":"post-605819","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-united-states","8":"tag-united-states","9":"tag-us","10":"tag-usa"},"share_on_mastodon":{"url":"https:\/\/pubeurope.com\/@uk\/115645844110502651","error":""},"_links":{"self":[{"href":"https:\/\/www.europesays.com\/uk\/wp-json\/wp\/v2\/posts\/605819","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.europesays.com\/uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.europesays.com\/uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/uk\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/uk\/wp-json\/wp\/v2\/comments?post=605819"}],"version-history":[{"count":0,"href":"https:\/\/www.europesays.com\/uk\/wp-json\/wp\/v2\/posts\/605819\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/uk\/wp-json\/wp\/v2\/media\/282671"}],"wp:attachment":[{"href":"https:\/\/www.europesays.com\/uk\/wp-json\/wp\/v2\/media?parent=605819"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.europesays.com\/uk\/wp-json\/wp\/v2\/categories?post=605819"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.europesays.com\/uk\/wp-json\/wp\/v2\/tags?post=605819"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}