Key point: The European General Court has upheld the European Commission’s adequacy decision for the EU-U.S. Data Privacy Framework, confirming that the United States ensures an adequate level of protection for personal data transfers.

Recap of the EU-U.S. Data Privacy Framework and Legal Challenge

Court’s Reasoning and Decision

What Could Result from the Court’s Decision?

For multinational organizations engaged in the collection, processing, storage or transfer of personal data of EU residents, the ruling provides short-term legal certainty and operational clarity. However, privacy advocates may continue to challenge the robustness of the DPF, particularly with respect to surveillance practices and judicial oversight in the U.S.

Possibility of Appeal and Next Steps

Under Article 56 of the Statute of the CJEU, the decision can be appealed within approximately two months. Thus, it is important to monitor whether Latombe or other parties pursue further legal action, which could once again subject the DPF to judicial scrutiny. The EU General Court also noted that the European Commission’s adequacy decision required continuous monitoring of the DPRC legal framework, and that changes to that framework could result in the Commission deciding to suspend, amend or repeal the adequacy decision. Accordingly, organizations relying on transatlantic data flows should remain vigilant to ensure that their data transfer mechanisms remain aligned to the DPF’s requirements, the structure and independence of the DPRC, or future legal challenges to the DPF itself.