Challenge To EU- US Data Transfers Fails

The Court of Justice for the European Union (CJEU) has handed down its judgment in the case of Latombe v Commission, underscoring the continuing validity of the EU-US Data Privacy Framework (DPF) as a lawful transfer mechanism under the GDPR.

What was the case all about?

Philippe Latombe, a French MP and CNIL Commissioner (CNIL being the French Data Protection Authority), lodged a request for the annulment of the DPF at the CJEU on 6 September 2023, making clear he was doing so in a personal capacity and not as a politician or member of a DPA.

Unlike the previous Schrems litigation, which involved preliminary rulings by the CJEU, Latombe brought a direct annulment action against the EU Commission's adequacy decision, which is the basis that underpins the DPF. This is a procedural and direct challenge and it is widely speculated this route was used to enable a quicker resolution.