Latombe Case: First hearing for annulment of the EU-U.S. Data Privacy Framework

Background

The EU-U.S. Data Privacy Framework (“DPF”) is a certification mechanism for U.S. organizations backed with U.S. government commitments governing transatlantic transfers of personal data between the EU and the U.S. By its adequacy decision of July 10, 2023, the European Commission found that the DPF, including an executive order from former President Biden, provided an adequate level of protection for personal data transferred from the EU to organizations in the U.S. (see our coverage of the DPF adoption, here). The DPF succeeds two predecessor adequacy decisions on similar mechanisms, namely the “Privacy Shield” that was invalidated by the European Court of Justice in 2020 (in the so-called “Schrems II” ruling) and the “Safe Harbor” that was similarly invalidated in 2015 (in the so-called “Schrems I” ruling).

On September 6, 2023, the French MP Philippe Latombe, who is a longstanding advocate of European digital sovereignty, and is also a commissioner of the French Data Protection Authority (CNIL), lodged an action seeking invalidation of the DPF before the General Court of the CJEU (Case T-553/23). Although Latombe was a member of the CNIL at the time of the request, and still is today, he specified in his request that he was acting in his personal capacity, as a citizen of the EU, and not as French MP or member of the CNIL.

Latombe’s request is based on Article 263(4) of the Treaty on the Functioning of the European Union (“TFEU”), which provides that “Any natural or legal person may, (…), institute proceedings against an act addressed to that person or which is of direct and individual concern to them, and against a regulatory act which is of direct concern to them and does not entail implementing measures” (see our coverage of this request, here). For the admissibility of his action, Latombe therefore needs to demonstrate both requirements of direct and individual concern. The individual concern criteria may be the most difficult criteria to demonstrate in this procedure. If these procedural criteria are met, the procedure will offer the advantage of speed compared to the prejudicial question procedure used in the past by Maximilian Schrems (see our coverage of the Schrems cases, here).

• Request for emergency suspension

On September 8, 2023, Latombe also asked for the suspension of the operation of the DPF under Articles 278 and 279 of the TFEU on basis of an alleged urgency to cancel the DPF. In principle, actions brought before the General Court do not have a suspensory effect. By way of exception, the TFEU provides that the Court may order, under certain conditions, that the application of the contested act be suspended or prescribe any necessary interim measures.

An urgency suspension request must state, under Article 156 of the Rules of Procedure of the General Court, “the subject-matter of the proceedings, the circumstances giving rise to the urgency, and the pleas of fact and law establishing a prima facie case for the interim measure applied for”. Urgency requires the applicant to demonstrate that the suspension is necessary to avoid serious and irreparable harm to their interests, whereby the burden of proof lies with the applicant.

On October 12, 2023, the President of the General Court examined and ultimately dismissed Latombe’s suspension request for emergency suspension made on September 8, 2023. The President considered that the urgency requirement was not met and that Latombe failed to demonstrate that he would suffer serious harm if the execution of the DPF was not suspended (see here for the General Court’s order rejecting the emergency request - French only).

• Main proceeding for annulment

Even if Latombe’s request for emergency suspension of the DPF did not succeed on procedural grounds, the main proceeding for DPF annulment based on the same claims is still pending. The General Court hearing of April 1, 2025, is part of this main proceeding. The hearing followed a period of written submissions and was an opportunity for Latombe and the European Commission to provide oral arguments and respond to the General Court’s questions directly. This hearing was eagerly expected as the General Court has the authority to annul the DPF.

Latombe’s request was based on the following main arguments:

• Languages: Latombe identified that the DPF decision was only available, at the time of his request, in English, whereas it should be translated into the official languages of the European Union (“EU”) under Regulation No 1/1958. This argument is unlikely to be accepted, as the DPF decision has since been published in all the EU official languages.
• Minimization and proportionality principles: Latombe considers that there would be a breach of the minimization and proportionality principles of the GDPR, resulting from "bulk collection of personal data" by U.S. surveillance authorities.
• Effective remedy: Latombe criticized the absence of guarantees of a right to an effective remedy, and in particular the lack of transparency with regards to the Data Protection Review Court (“DPRC”) procedure, on the basis of the Charter of Fundamental Rights of the European Union and the GDPR.
• Automated decision: Latombe alleged the absence of a framework in U.S. law regarding automated decision-making and that the DPF does not solve the risk of occurrence of such data processing.
• Security: Latombe alleged the absence of safeguards regarding the security of processed data once transferred to the U.S., on the basis of Article 32 GDPR.

The Court analyzed both procedural and substantive aspects during the hearing of April 1, 2025.

The European Commission representative specified that U.S. law limits the possibility for U.S. surveillance agencies to use bulk collection techniques to access EU personal data. The European Commission also recalled that targeted collection of EU personal data under U.S. law is limited to specific purposes only, including fighting against terrorism, espionage, weapons of mass destruction, cyberthreats, threats against the personnel of the United States or its allies, and transnational crime.

The European Commission also reminded the General Court that EU citizens can still refer to the DPRC to seek redress for violations of their privacy rights and highlighted that the independent authority of executive branch courts like the DPRC has been recognized by the U.S. Supreme Court and that applied safeguards are sufficient.

The European Commission’s arguments during the April 1, 2025, hearing largely echoed those already documented in its DPF adequacy decision, and confirmed in its first review of the functioning of the DPF (see here), in particular confirming that “U.S. authorities have put in place the necessary structures and procedures to ensure the DPF functions effectively”. The European Commission expects the General Court to agree with its assessments.

Next steps

The General Court should issue a decision for this main proceeding in a few weeks or months. It has the authority to invalidate the DPF.

EU and U.S. companies relying on the DPF or other GDPR mechanisms for transatlantic data flows should therefore closely monitor further developments. To the extent EU data exporters rely on the DPF, they may consider using Standard Contractual Clauses for international data transfers and/or Binding Corporate Rules (where available) as fallback options.

Nevertheless, General Court’s decisions could still be appealed to the CJEU, which would occur if one of the parties is unsatisfied with the decision and believes it can obtain a favorable decision on appeal. In case of an appeal, the General Court’s decision would not become immediately enforceable until the resolution of the appeal proceedings before the CJEU, if any. While this case has heightened uncertainty for the future of transatlantic data flows, any resulting action would take some time – at least 18 months – to take effect, as the case may be.

Mr. Latombe’s claim is grounded on the content of the DPF itself. Potential rejection of his request does not exclude the possibility of any future request grounded on the actual application of the DPF under the new U.S. administration.

Authored by Julie Schwartz, Etienne Drouard, Julian Flamant, Henrik Hanssen, and Augustin Lacroix.