Latombe v Commission: Judicial Endorsement of the EU-US Data Privacy Framework

By

Meri Batikyan

CyJurII Scholar

on 11 November  2026

Citation Number: Case T-553/23-Latombe v Commission EU:T:2025:831 (General Court, Tenth Chamber, Extended Composition, 3 September 2025)

1. Facts and procedural history

In Schrems I (C-362/14, 2015) and Schrems II (C-311/18, 2020), the Court of Justice invalidated the two earlier EU-US transfer frameworks, Safe Harbour and the Privacy Shield. In Schrems II, US surveillance was not limited to what is strictly necessary, and EU data subjects had no effective remedy, because the Privacy Shield Ombudsperson was not an independent tribunal.

The US responded with Executive Order 14086 of 7 October 2022. It limits signals intelligence to defined national-security objectives and creates a two-layer redress mechanism: complaints go first to the Civil Liberties Protection Officer (CLPO) in the Office of the Director of National Intelligence, then on appeal to the Data Protection Review Court (DPRC). The DPRC was created by an Attorney General regulation, and its judges are appointed by the Attorney General after consulting, among others, the Privacy and Civil Liberties Oversight Board (PCLOB).

On 10 July 2023, the Commission adopted Implementing Decision (EU) 2023/1795, finding that the EU-US Data Privacy Framework (DPF) ensures an adequate level of protection. Philippe Latombe, a French MP, sought its annulment on 6 September 2023, and his request for interim measures was rejected on 12 October 2023. On 3 September 2025, the General Court dismissed the action in its entirety, the first time an EU court had ruled on the DPF.

2. The legal question

The question was whether US law, as reshaped by Executive Order 14086, ensures a level of protection “essentially equivalent” to that guaranteed by the GDPR read in the light of the Charter. Latombe raised five pleas but withdrew the first, on languages, at the hearing (paras 16-17). The remaining four concerned the right to an independent tribunal (Article 47 of the Charter), bulk collection (Articles 7 and 8), automated decisions (Article 22 GDPR) and data security (Article 32 GDPR).

The Court did not rule on the Commission’s objection to admissibility, and decided the merits in the interests of the proper administration of justice (paras 14-15). It assessed the decision on the facts and law as they stood when it was adopted (para 22).

3. The Court’s reasoning

Independence of the DPRC

Latombe argued that the DPRC is not an independent tribunal established by law. It reviews decisions of the CLPO, who sits within the Office of the Director of National Intelligence; its judges are appointed after consulting the PCLOB, which he called an executive body; and it was created by an Attorney General regulation, not an Act of Congress (paras 39, 51, 64).

The Court rejected each point. The CLPO’s independence was irrelevant, because the DPRC reviews CLPO decisions in full and its rulings bind the government (paras 42-46). DPRC judges are appointed on the criteria used for federal judges and may be dismissed only for cause (paras 43, 56), and the PCLOB was conceived by its founding statute as independent (paras 53-55).

On the lack of a statute, the Court looked past the form of the instrument to the safeguards it contains (para 71). Because the Attorney General’s delegation binds the executive for as long as the regulation stays in force, the DPRC offers guarantees essentially equivalent to Article 47 of the Charter (paras 75-81).

The Court also pointed to the Commission’s duty to monitor the framework continuously, and to suspend, amend or repeal the decision if US law changes (para 58).

Bulk collection

Latombe argued that US agencies may collect data in bulk without prior authorisation by a judicial or administrative authority (para 92). The Court held that Schrems II requires, as a minimum, ex post judicial review, which the DPRC provides (paras 105–106). Bulk collection is also allowed only where targeted collection cannot serve a validated priority, and only for six listed objectives, such as terrorism and cyber threats (paras 107–117).

The Court accepted that Big Brother Watch v United Kingdom was relevant, and that it lists independent authorisation at the outset among the safeguards for bulk interception (paras 133, 140). But it treated that as one safeguard among several, held that the initial collection stage needs fewer safeguards, and found US law sufficient overall (paras 144-146).

Other pleas

The pleas on automated decisions and data security also failed. Cases outside the GDPR’s reach are residual and covered by US sectoral laws, and the decision need not copy the GDPR’s wording (paras 174-177, 200-203).

4. Significance

First, the judgment secures, for now, the routine data flows that rely on the DPF, which allows personal data to move from the EU to certified US organisations without further transfer safeguards.

Second, it clarifies two standards. It reads Schrems II as requiring, at minimum, ex post judicial review of bulk collection rather than prior authorisation (para 105). It also accepts that a body created by the executive can satisfy Article 47, provided its safeguards ensure independence in substance (paras 71-72).

Third, it is not the last word. Latombe’s appeal (C-703/25 P) puts the DPRC’s independence and the Court’s approach to bulk collection before the Court of Justice, where Microsoft was admitted as an intervener for the Commission in June 2026.

5. Critique

A frozen snapshot. The Court’s most consequential choice is to judge the decision only as of July 2023 (para 22), which shields it from anything that happened afterwards.

The cost is already visible. The Court found the PCLOB independent partly because of its bipartisan, five-member board (para 53), yet in January 2025 the President dismissed its Democratic members. On 29 June 2026, the US Supreme Court held in Trump v Slaughter that FTC commissioners may be removed at will. The FTC enforces companies’ DPF commitments, and on 31 July 2026 the European Data Protection Board asked the Commission to assess the ruling’s effect.

None of this could be weighed in Latombe. The Court left it to the Commission to monitor the framework and act if US law changes (para 58).

Independence on paper. The Court said the form of an instrument matters less than its safeguards (para 71), but the safeguards it relied on are largely textual. It accepted that the executive is bound only as long as the Attorney General regulation remains in force (para 75).

Ex post review. On bulk collection, the Court’s reading of Schrems II is defensible, since that judgment did not expressly require prior authorisation. Its use of Big Brother Watch is weaker. The ECtHR placed independent authorisation at the outset, when an operation’s object and scope are defined, yet the General Court reasoned that this first stage needs fewer safeguards (paras 140, 144). Latombe’s appeal presses exactly this point.

Admissibility left open. The Court never decided whether Latombe had standing under Article 263(4) TFEU (paras 14-15), so it remains unclear whether individuals can challenge adequacy decisions directly.

6. Conclusion

Latombe is best read as a provisional endorsement. It secures transatlantic data flows, but on narrow ground: a review frozen in July 2023, independence assessed largely from legal texts, and admissibility left open. With the appeal pending and noyb threatening a separate challenge based on Trump v Slaughter, organisations relying on the DPF should keep a fallback, such as standard contractual clauses, ready.

For cyber jurisprudence, the case shows the limits of reviewing a moving target through a fixed snapshot. Safeguards built on executive acts and independent agencies can change faster than courts can review them. The Court of Justice must now decide whether EU law asks what US rules say, or how they work in practice.

References

Cases

1. Case T-553/23 Latombe v Commission EU:T:2025:831 (https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023TJ0553)

2. Case C-703/25 P Latombe v Commission (appeal lodged 31 October 2025, pending) OJ C/2025/6610 (https://eur-lex.europa.eu/eli/C/2025/6610/oj/eng)

3. Case C-362/14 Maximillian Schrems v Data Protection Commissioner EU:C:2015:650 (https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62014CJ0362)

4. Case C-311/18 Data Protection Commissioner v Facebook Ireland Ltd and Maximillian Schrems EU:C:2020:559 (https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62018CJ0311)

5. Big Brother Watch and Others v United Kingdom App nos 58170/13, 62322/14 and 24960/15 (ECtHR, Grand Chamber, 25 May 2021) (https://hudoc.echr.coe.int/eng?i=001-210077)

6. Trump v Slaughter 609 US 422 (2026) (https://www.supremecourt.gov/opinions/25pdf/609us2r62_g314.pdf)

Legislation and official documents

1. Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 on the adequate level of protection of personal data under the EU-US Data Privacy Framework [2023] OJ L231/118 (https://eur-lex.europa.eu/eli/dec_impl/2023/1795/oj/eng)

2. Executive Order 14086, Enhancing Safeguards for United States Signals Intelligence Activities (7 October 2022) (https://www.federalregister.gov/d/2022-22531)