Privacy Across The Atlantic: The Data Privacy Framework's (DPF) First Victory In Court

The EU–US Data Privacy Framework has withstood its first major legal challenge before the EU General Court (General Court in Case T-553/23 | Latombe v Commission). As with the two earlier frameworks – the EU–US Safe Harbor (invalidated in 2015) and the EU–US Privacy Shield (invalidated in 2020) – the legality of the current Data Privacy Framework (DPF) has been scrutinised in relation to transfers of personal data to the United States and whether it ensures adequate protection of the rights and freedom of data subjects.

Case Background:

A member of the French parliament Philippe Latombe (acting in his individual capacity and not as a Government Official) brought a challenge before the EU General Court seeking the annulment of the 2022 European Commission decision to adopt an adequacy decision for the EU-US Data Privacy Framework that allows unobstructed transfers of personal data to the US for entities and data controllers that are registered with the framework.