General Court on the EU-U.S. Data Privacy Framework.

Philippe Latombe, a French citizen and member of the National Assembly, had filed a lawsuit seeking to invalidate the adequacy decision regarding the EU-U.S. Data Privacy Framework. He argued that the Data Protection Review Court (DPRC), established by Executive Order 14086 and the Attorney General’s Regulation, is not an independent court created by law within the meaning of Article 47(2) of the Charter of Fundamental Rights. Furthermore, the mass collection of data by U.S. intelligence agencies constitutes a severe infringement on the fundamental rights to privacy and data protection. 

The court made it clear that the formal source of law is not decisive for the assessment under EU law. Instead, what matters is whether the relevant U.S. regulations provide substantive guarantees of independence, impartiality, and effective judicial review. After analyzing the rules governing the appointment, tenure, and removal of DPRC judges, as well as procedural rights, the court concluded that the shortcomings identified in Schrems II had been remedied and that the DPRC offers essentially equivalent safeguards.

With regard to intelligence-related data collection, the Court reaffirmed that EU law does not require mandatory prior authorization formass data collection—at least as long as there is ex post independent oversight, clear legal bases, and multi-layered oversight mechanisms. In the United States, these are guaranteed by E.O. 14086, the DPRC, the PCLOB, the Inspectors General, and the congressional oversight committees.

The Commission thus properly exercised its discretion under Article 45 of the GDPR and did not violate Article 7, Article 8, or Article 47 of the Charter of Fundamental Rights. The adequacy decision therefore remains fully valid.

Sources