EU General Court Upholds EU–US Data Privacy Framework

On 3 September 2025, the EU General Court (T-553/23, Latombe v Commission) dismissed an action challenging the European Commission's adequacy decision 2023/1795 of July 2023 on the EU–US Data Privacy Framework.

The applicant argued that the framework failed to provide EU citizens with a level of protection "essentially equivalent" to that guaranteed under EU law, a standard that had led the Court of Justice to invalidate both the Safe Harbour (2015) and the Privacy Shield (2020) in the well-known Schrems I and Schrems II rulings.

The Court, however, confirmed that the reforms introduced by the United States, in particular Executive Order 14086 and the creation of the Data Protection Review Court (DPRC), provide sufficient guarantees of independence and impartiality. It held that the DPRC qualifies as an effective redress mechanism in line with Article 47 of the Charter of Fundamental Rights.