The General Court Upholds The EU–US Data Privacy Framework

Data Privacy Framework

Following the post-Schrems II regime, the EU–US Data Privacy Framework ("DPF") emerged as the Commission's latest attempt to secure lawful transatlantic data flows. Adopted in July 2023 through Commission Implementing Decision (EU) 2023/1795, the adequacy decision sought to remedy the deficiencies that had twice led the Court of Justice of the European Union ("CJEU") to strike down its predecessors: Safe Harbor in Schrems I and Privacy Shield in Schrems II.¹

On 3 September 2025, the General Court delivered its long-awaited judgment in Latombe v. Commission (T-553/23),² dismissing an action for annulment and upholding the Commission's adequacy assessment.