DATA PROTECTION | General Court upholds EU-US Data Privacy Framework

On 3 September 2025, the General Court of EU (GC) delivered a landmark judgment in case T-553/23 (Latombe v Commission) addressing the validity of the Commission Implementing Decision (EU) 2023/1795 (EU-US Data Privacy Framework) for international transfers of personal data to the US. The action was brought by Philippe Latombe, a member of the French Parliament, who argued that the EU-US Data Privacy Framework was invalid. He claimed that the US Data Protection Review Court (DPRC) – the redress mechanism available to European data subjects to claim unlawful processing of their data – lacked independence, and that US law did not ensure safeguards equivalent to those required under the GDPR.

The GC dismissed these arguments and upheld the Commission’s decision, confirming that the EU-US Data Privacy Framework ensures adequate protection for personal data transferred overseas.

Newsletter n. 110 – August/September 2025