On Sept. 3, 2025, in a much-anticipated legal decision, the European General Court (EGC) rejected the request of a French member of Parliament to annul the EU-U.S. Data Privacy Framework (DPF or Framework). 

Although this decision reinforces that U.S. organizations that have self-certified as to their adherence to the DPF principles may continue to receive and process European Union data subjects’ personal data without need for another lawful data transfer mechanism (such as Standard Contractual Clauses or binding corporate rules), the case may still be appealed within the next two months to the Court of Justice of the European Union (CJEU) for final adjudication. 

For now, continuity of the U.S. DPF adequacy decision remains in full force, avoiding immediate need for the more than 3,400 participating U.S. entities to undertake contract or transfer impact assessment updates if relying exclusively on DPF for EU customer, employee or partner data exports.

Below is a brief background of the case and an overview of the General Court’s rejection of MP Latombe’s arguments, which resulted in the trans-Atlantic data transfer agreement being upheld. 

Background

After the invalidation of the EU-U.S. Privacy Shield Framework (EUPS) on July 16, 2020, by the CJEU in the “Schrems II” decision (see GT summary), and following years of negotiations between U.S. and European trade officials, in July 2023 the European Commission determined that the DPF, as supported by U.S. presidential executive orders, provided an adequate level of protection for personal data transferred from the EU to U.S. organizations self-certifying to the Framework. The Framework is managed by the U.S. Department of Commerce and enforced by the U.S. Federal Trade Commission. 

MP Latombe, who is also a commissioner of the French data protection supervisory authority (CNIL), submitted a request in his personal capacity in September 2023 that the General Court invalidate DPF. A month later, the President of the General Court dismissed Latombe’s call for an emergency suspension of DPF but kept open the primary DPF annulment request. Oral arguments before the General Court were held on April 1, 2025, following written submissions.

Dismissal of Latombe’s Legal Claims Against DPF

A more detailed breakdown of the General Court’s decision (here, in French) will follow, but the primary points may be summarized as such:

• The EGC did not agree with MP Latombe that the DPF’s Data Protection Review Court (DPRC) failed to offer EU data subjects an adequate level of protection, finding that the DPRC is a sufficiently independent and impartial tribunal (and not solely dependent on the U.S. Executive Branch).
• The EGC emphasized that the European Commission is required to monitor the functioning of the legal framework, as part of its ongoing duty to determine whether the United States, as a “third country,” meets the EU General Data Protection Regulation (GDPR)’s “adequacy” requirements (i.e., is substantially equivalent to EU standards). It noted that procedures are in place for the Commission to suspend, amend, restrict or repeal the DPF, as needed.
• The EGC rejected the claim that the bulk collection of personal data by U.S. intelligence agencies (a) should be subject to prior authorization of a court or independent administrative authority and (b) is not subject to judicial supervision or governed by sufficiently defined rules. The General Court held that, given that Executive Order 14086, among other legal instruments and procedures, establishes that bulk collection is only permissible for defined intelligence priorities and pursuant to certain oversight—including within each individual intelligence agency, as well via as the ex post oversight of the DPRC, Privacy and Civil Liberties Oversight Board (PCLOB), and other checks—this was unfounded and not in line with the legal holdings of the Schrems II decision. 

Notably, the ECG’s judgment appears to be based on U.S. law and governmental activities as of the July 2023 EU adequacy decision, omitting reference to developments since that time.

An Appeal Looms

The EU-U.S. Data Privacy Framework will now remain in effect indefinitely, subject to its periodic reviews by European Parliament, the European Data Protection Board and, ultimately, the final determination of the European Commission. 

Under Article 56 of the Statute of the CJEU, rulings made by the General Court may be subject to an appeal to the CJEU within two months of the date of the decision’s notification. No indication has been given by Latombe as of the time of this writing as to whether an appeal will be filed. In a statement published by NOYB.eu, privacy advocate Max Schrems opined in a “first reaction” to the Latombe case that, “We are very surprised about this outcome. It may be that the General Court did not have sufficient evidence before it – or it wants to make a point to depart from the CJEU. We will have to analyse the ruling in more detail [in] the next days.”