News

Member of French Parliament lodges first request for annulment of EU-US Data Privacy Framework

08 September 2023

P. Latombe, who is not only a Member of the French Parliament, but also seated at the French Data Protection Authority (CNIL)'s Commission, lodged a request for annulment of the DPF on 6 September 2023 before the Court of Justice of the European Union (CJEU). Latombe, however, specified in his press release that he is acting "in a personal capacity, as a simple citizen of the Union, and not as a French MP, Law Commissioner or CNIL Commissioner."

Latombe's request, reportedly spanning 33 pages and accompanied by numerous annexes, is based on Article 263 of the Treaty on the Functioning of the European Union (TFUE) that states that "Any natural or legal person may, under the conditions laid down in the first and second paragraphs, institute proceedings (...) against regulatory acts which directly concern them and which do not involve implementing measures".

Admissibility of the request

The first step for the CJEU will be to analyse whether Latombe's request is admissible. Indeed, as he is acting as an individual, he qualifies as a "non-privileged applicant", which means that he is subject to stringent conditions to satisfy the legal standing requirement for his request to be admissible.

Based on the CJEU caselaw, he will need to demonstrate that the DPF is both of direct concern (CJEU Case C-486/01 Front national v. European Parliament) and of individual concern (CJEU Case C-25/62 Plaumann v. Commission) to him.

If both requirements of direct and individual concerns are met, although the individual concern criteria seems difficult to demonstrate here, the procedure will offer the advantage of speed compared to the prejudicial question procedure used by Maximilian Schrems (see our coverage of the Schrems cases, here).

Content of the request

Latombe used the main following legal arguments:

Effective remedy: Latombe is criticizing in his request the absence of guarantees of a right to an effective remedy, and in particular the lack of transparency in the newly created Data Protection Review Court (DPRC) procedure.
Minimization and proportionality principles: He is also raising the argument of the breach of the minimization and proportionality principles of the GDPR, in particular due to what he identifies as "bulk collection of personal data" by the U.S. surveillance authorities.
Languages: Latombe also makes a point regarding the language of the DPF decision, that is for now only available in English, but should also be translated into the official languages of the European Union (EU).

The forthcoming decision by the CJEU, both in terms of admissibility and substance, promises to wield a major impact. It will become another cornerstone in the evolving case law in this field, marking a crucial point in transatlantic data transfers.