Latombe v. European Commission: the DPF, ça tombe?

Background

Latombe argues that the DPF violates the fundamental rights of EU citizens, in particular because of US surveillance practices. Among other things, Latombe argues that the United States does not provide:

• Adequate safeguards for the protection of the privacy of data subjects due to the widespread and ‘bulk’ collection of personal data by the United States;
• Access to an independent court;
• Safeguards against automated decision-making.³

These objections relate to the alleged limitations of the DPF itself and are independent of the policies of specific US administrations. Latombe brought this case during Joe Biden's presidency, while the Court is now ruling during Donald Trump's administration.

The ruling

This morning, the Court published a clear press statement⁴: the DPF will not be revoked. Organisations that depend on transfers of personal data to the US, for example in the form of cloud services or AI tools, can therefore breathe a sigh of relief for the time being.

The Court rejects Latombe's main claims regarding the independence and impartiality of the Data Protection Review Court, the body responsible for addressing the objections raised in Schrems II, and regarding the ‘bulk’ collection of data by US intelligence services.

On the first point, the General Court states that the independence and impartiality of the members of the DPRC are sufficiently guaranteed. For example, only the US Solicitor General can dismiss judges, and only with good reason.⁵

With regard to the “bulk” collection by US intelligence services, the Court states that US intelligence services are subject to ex post judicial review by the DPRC. The Scherms II ruling does not indicate that prior review is required.

What now?

As we wrote earlier, this is a ruling by the General Court, which means that Latombe can still appeal the ruling to the Court of Justice. If that happens, a final ruling will take at least 18 months. Even if the ruling were different, the consequences for organisations would not be immediate. Nevertheless, the General Court seems to give Latombe limited grounds for an appeal. In practice, many organisations depend on transfers to the US in particular. This makes declaring an adequacy decision invalid for a third time a sensitive issue.

In practice, transfers in the absence of an adequacy decision often prove difficult to arrange, as evidenced, for example, by the fine recently imposed on Uber by the AP.⁶ It remains to be seen whether the Court of Justice, contrary to the findings of the General Court, will again see reason to torpedo the DPF. Perhaps we will have to wait for Schrems III after all.

‍

_{1. The General Court of the European Union is a court of first instance and part of the Court of Justice of the European Union (CJEU). This means that this ruling can still be appealed, after which the CJEU will make a final decision.}

_{2. CJEU 6 October 2015, C-362/14 (Maximillian Schrems v Data Protection Commissioner), ECLI:EU:C:2015:650; CJEU 16 July 2020, C-311/18 (Data Protection Commissioner v Facebook Ireland Limited and Maximillian Schrems), ECLI:EU:C:2020:559.}

_{3. Action brought on 6 September 2023 – Latombe v Commission (Case T-553/23). Available at: https://curia.europa.eu/juris/document/document.jsf?docid=279601&doclang=EN. Accessed on 2 September 2025.}

_{4. CJEU 3 September 2025, ‘Data Protection: the General Court dismisses an action for annulment of the new framework for the transfer of personal data between the European Union and the United States,’ Press release No 106/25. Available at: https://curia.europa.eu/jcms/upload/docs/application/pdf/2025-09/cp250106en.pdf.}

_{5. The current US administration interprets the concept of ‘for cause’ very liberally, as evidenced by the proposed dismissal of Federal Reserve Governor Lisa Cook. See: NOS, ‘Trump dismisses central bank director,’ 26 August 2025. Available at: https://nos.nl/artikel/2579947-trump-ontslaat-bestuurder-centrale-bank. Accessed on 3 September 2025.}

_{6. Dutch Data Protection Authority, ‘AP fines Uber €290 million for transferring driver data to the US’, 2 August 2024. Available at: https://www.autoriteitpersoonsgegevens.nl/en/current/dutch-dpa-imposes-a-fine-of-290-million-euro-on-uber-because-of-transfers-of-drivers-data-to-the-us. Accessed on 3 September 2025}