On 9 September 2025, the EU General Court delivered its first major judgment on the EU–US Data Privacy Framework (DPF) in Case T-553/23 (Latombe v Commission), rejecting an action seeking the annulment of the European Commission’s 2022 adequacy decision. The ruling marks a significant milestone for transatlantic data transfers, distinguishing the DPF from its predecessors, Safe Harbor (invalidated in 2015) and Privacy Shield (invalidated in 2020).
The applicant challenged the adequacy decision on several grounds, including concerns over U.S. surveillance practices, large-scale data collection, access to an independent tribunal, and safeguards against automated decision-making. The Court dismissed these claims, finding that U.S. law provides sufficient limitations and safeguards, including targeted intelligence collection under FISA, and that the newly established Data Protection Review Court satisfies the requirements of independence and effective judicial redress under Article 47 of the EU Charter of Fundamental Rights and Article 45 GDPR.
Importantly, the Court reaffirmed that an adequacy framework does not need to mirror GDPR identically but must ensure an “essentially equivalent” level of protection. The decision provides increased legal certainty for businesses relying on the DPF for EU–US data transfers and signals judicial recognition of U.S. reforms aimed at strengthening oversight and redress mechanisms.
While a potential appeal remains possible, the judgment offers cautious optimism that the DPF may provide greater stability for cross-border data flows within the EU–US economic relationship.