Introduction
On 3 September 2025, the Basic Court docket of the EU delivered its judgement in case T-553/23 Latombe v. Fee. The Basic Court docket (GC) dismissed the direct motion introduced by Mr Philippe Latombe, a Member of the French Parliament, in opposition to the so-called “EU-US Knowledge Privateness Framework”. This framework, accepted with Fee Implementing Resolution (EU) 2023/1795, designated the USA as a 3rd nation that ensures an satisfactory degree of safety of non-public information pursuant to Article 45 GDPR and allowed information transfers to US organisations included within the ‘Knowledge Privateness Framework Record’.
In brief, the applicant alleged that the choice didn’t adjust to the necessities set out in Article 45(2) GDPR and violated Articles 7, 8 and 47 of the Constitution. With out inspecting the Fee’s pleas relating to the admissibility of the motion, the GC straight dominated on the substance of the case and dismissed the motion. The GC rejected all of the applicant’s pleas, holding that none of them might show that the extent of safety of non-public information within the USA doesn’t adjust to the circumstances supplied for by Article 45(2) GDPR.
This put up doesn’t goal to supply an intensive abstract of the reasoning of the GC, nor to exhaustively assess the validity of the EU-US Knowledge Privateness Framework. Quite the opposite, it would critically interact with particular factors of the judgment, specifically (1) the admissibility of the motion, (2) the analysis of details arising after the adoption of the choice, (3) the existence of an efficient judicial treatment for EU information topics. It’ll argue that the GC’s method disregarded the ratio each of the ECJ’s case regulation on the admissibility of direct actions and of the Schrems instances on EU-US information transfers.
Background of the case
Transfers of non-public information to 3rd nations, significantly to the USA, have lengthy been a contentious challenge in information safety regulation. Certainly, precisely on this matter, the ECJ has delivered two of its most essential judgements relating to information safety, i.e. the rulings in instances Schrems I and II. As is broadly recognized, with these judgments, the Court docket declared invalid the earlier EU-US adequacy choices (Fee Resolution 2000/520/EC, “Protected Harbour,” and Fee Implementing Resolution (EU) 2016/1250, “Privateness Defend”).
In a nutshell, the rules pinpointed by the ECJ in these instances had been as follows. First, the extent of safety of non-public information within the third nation doesn’t have to be similar to that assured within the EU. As a substitute, this degree wants, by purpose of home regulation or worldwide commitments, to be “primarily equal” to the one within the EU (Schrems I, para. 73). Second, laws of the third nation can not authorise public authorities to have entry to the content material of digital communications on a generalised foundation (Schrems I, paras. 93-94). Furthermore, authorized bases allowing the implementation of surveillance measures on EU information topics should, in accordance with the precept of proportionality, lay down clear and exact guidelines governing the scope and the applying of such measures and imposing safeguards for the people (Schrems II, paras. 178, 180). Third, information topics will need to have authorized cures to have entry to their information or to acquire its rectification or erasure (Schrems I, para. 95). A “Privateness Defend Ombudsman”, who straight reported to the US government department below the Privateness Defend framework and didn’t have the ability to undertake binding choices, couldn’t be thought to be “an unbiased and neutral tribunal beforehand established by regulation” (Schrems II, paras. 193-197).
Following this final result, on 10 July 2023, the Fee adopted Fee Implementing Resolution (EU) 2023/1795, approving the “EU-US Knowledge Privateness Framework”. It’s in opposition to this act that Mr Latombe introduced his motion earlier than the GC within the case at hand.
Does Mr Latombe have standing? We have no idea
The primary exceptional side of the judgment issues the admissibility of the motion. Opposite to the Schrems instances, which stemmed from a preliminary reference of a nationwide choose on the validity of the adequacy choice, Mr Latombe introduced a direct motion for annulment. Article 263(4) TFEU units strict necessities for such an motion to be admissible, specifically that the challenged act is (1) of direct and particular person concern to the applicant or that (2) it’s a regulatory act which is of direct concern to them and doesn’t entail implementing measures. Since its Plaumann case, the CJEU has adopted a restrictive method relating to these necessities.
Firstly, it may be argued that, within the case at hand, the applicant is, on the very least, not individually involved by the challenged act. For him being ‘individually involved’, the choice would wish to have an effect on him “by purpose of sure attributes that are peculiar to [him] or by purpose of circumstances wherein [he is] differentiated from all different individuals” (Nord Stream 2 v Parliament and Council, para. 156). Nevertheless, nothing means that Mr Latombe could be in such a scenario, since this choice impacts all information topics within the EU whose information are transferred to the US, with out particularly affecting solely him. Due to this fact, the GC might have dismissed the motion on procedural grounds by merely ascertaining the dearth of particular person concern.
Secondly, it’s unclear whether or not the applicant claimed that the attacked choice is a regulatory act straight regarding him and never entailing implementing measures within the sense of the final limb of Article 263(4) TFEU. Nevertheless, the next factors might be famous. On the one hand, Resolution (EU) 2023/1795 – being a non‑legislative act of normal software – might really fall throughout the definition of “regulatory act” as interpreted by the CJEU in Inuit Tapiriit Kanatami (paras. 58-60). Then again, Golunova and Eliantonio level out that it could be very tough for the applicant to show the choice has a direct opposed impact to him, since he would wish to display which particular destructive penalties he suffered as a result of this choice.
Earlier than the judgment was delivered, many students anticipated the GC to dismiss the case on procedural grounds (Golunova and Eliantonio 2024, 191; Barczentewicz 2023, 4). Conversely, the courtroom opted for an uncommon method, selecting to not deal with the problem of admissibility and as an alternative straight inspecting the substance of the motion. It held that, on this case, circumstances referring to the right administration of justice justified the dismissal of the motion on the deserves with out beforehand ruling on the objection of inadmissibility (paras. 14 and 15).
As identified within the ruling, the GC has already used this precept previously (e.g. see Marchiani v Parliament, para. 23), and the ECJ doesn’t appear to criticise this apply (e.g. see Council v Boehringer, para. 51 and 52). Nevertheless, the applying of this precept to the case at hand is questionable.
First, the earlier paragraphs have proven that the GC would have had a number of arguments to swiftly reject the motion on procedural grounds. Quite the opposite, the GC selected to have interaction in a relatively lengthy dialogue on the deserves of the case, which entailed evaluating parts of the US authorized system and analyzing 4 pleas raised by the applicant. Thus, one wonders how embarking in an extended and harder evaluation would assist make sure the “correct administration of justice”.
Secondly, the GC’s selection doesn’t contribute to rising authorized certainty both. Certainly, as identified under, this ruling shouldn’t be a set-in-stone approval of the adequacy choice and uncertainty stays on whether or not it could possibly be annulled sooner or later.
Thirdly, this method shouldn’t be a loosening of the CJEU’s restrictive admissibility standards. Notably, the GC merely “skipped” the procedural argument, with out saying whether or not the motion is admissible or not. It’s value noting that this reasoning works solely within the occasion of a rejection of the motion. Within the reverse case, it could be logically unimaginable to uphold the motion on the deserves with out inspecting whether or not the applicant has standing to carry it.
The relevance of details arising after the adoption of the choice
In keeping with the GC, solely the authorized and factual parts present on the time when the choice was adopted are related for evaluating the validity of the choice (para. 22). Conversely, as for the following parts, it could be for the Fee to amend or repeal the choice whether it is to seek out that the US now not guarantee an satisfactory degree of safety (para. 58).
This line of reasoning is debatable. Firstly, it patently clashes with Schrems I. In that case, the ECJ dominated that “when the validity of a Fee [adequacy] choice […] is examined, account should even be taken of the circumstances which have arisen after that call’s adoption” (Schrems I, para. 77). The Court docket additionally shared the Opinion of AG Bot on this case, who identified that the evaluation of an adequacy choice “will essentially evolve in accordance with the factual and authorized context prevailing within the third nation” (para. 134). Whereas the GC quoted some case regulation (equivalent to Alcogroup and Alcodis v Fee, para. 45) to help its argument (para. 22), it didn’t present causes for which these instances could be extra related than Schrems I. Moreover, it failed to think about that, even exterior information safety issues, the ECJ had already dominated that “the validity of a measure would possibly, in sure instances, be assessed by reference to new elements which arose after its adoption” (Gaz de France – Berliner Investissement, para. 50; SAM Schiffahrt and Stapf, para. 47).
Secondly, adopting this angle would arguably have unacceptable penalties from the viewpoint of the precise to an efficient judicial treatment set out in Article 47 of the Constitution. Pursuant to this text, a person should be capable to declare that their private information was unlawfully transferred to the USA earlier than a courtroom. This stays the case each (1) the place the breach arises from circumstances present on the time the adequacy choice is adopted, and (2) the place such circumstances emerge thereafter. The reasoning of the GC entails that a person can not achieve this within the latter case.
Notably, the GC doesn’t explicitly hyperlink its reasoning to the truth that the case at hand stems from a direct motion. Thus, this precept might additionally apply to different varieties of process earlier than the CJEU, together with a preliminary reference on the validity of the adequacy choice. This might imply that a person has no means to problem its validity by alleging details that arose after the adoption. Certainly, solely the CJEU, and never nationwide judges, can declare the invalidity of an EU act (Foto-Frost, para. 20).
Lastly, the truth that the Fee is below an obligation to assessment the choice pursuant to Article 3(1) of Resolution (EU) 2023/1795 shouldn’t be significantly useful for the aim of assessing whether or not such a judicial treatment is out there. For this to be true, a person would wish to have the ability to successfully problem in courtroom the inactivity of the Fee.Whereas EU regulation permits people to take action by way of an motion for failure to behave pursuant to Article 265(3) TFEU, the admissibility necessities for this sort of motion are akin to those set by the Court docket in Plaumann (Lenaerts, Gutman and Nowak 2023, 419-20). Thus, in apply, people can not problem such an inactivity of the Fee with out proving that they’re, no less than, individually involved by it. As already defined above, this doesn’t appear potential for an act which equally impacts 1000’s of information topics within the EU.
Do EU information topics have an efficient judicial treatment?
As for the substance of the case, this contribution will give attention to the GC’s reasoning in regards to the existence of an efficient judicial treatment pursuant to Article 47 of the Constitution. With the intention to deal with the remarks on the respect of Article 47 of the Constitution made in Schrems II, President Biden accepted Govt Order 14086 (EO). Amongst others, the latter created a two-layer redress mechanism. Knowledge topics can lodge a criticism, which can first be examined by a Civil Liberties Safety Officer (CLPO), a physique appointed by and reporting to the Director of Nationwide Intelligence. Subsequently, complainants can attraction the CLPO’s choice earlier than the Knowledge Safety Assessment Court docket (DPRC). The latter consists of no less than six judges, who’re appointed by the USA Legal professional Basic after consulting the Privateness and Civil Liberties Oversight Board (PCLOB).
As for this mechanism, it may be debated whether or not it actually fulfils the necessities set out in Schrems II. On the one hand, because the GC rightfully identified (paras. 45, 48, 56), this EO launched some enhancements, such because the binding nature of the CLPO and DPRC choices and the existence of safeguards on the elimination of the DPRC judges. Then again, students had raised issues relating to the independence of the DPRC, underlining that it could possibly be impaired if the members are appointed by a political physique (Batlle and van Waeyenberge 2023, 198; Savin 2023, 164) or, no less than, if they’ll obtain oblique political stress by the chief (Giacalone 2023, 155-56).
The GC dismissed such issues, holding that the DPRC is unbiased as a result of EO 14086 states that its members should be appointed utilizing the identical standards as those who apply to the federal judiciary (para. 43). Furthermore, it identified that the DPRC is supervised by an unbiased physique, the PCLOB (para. 54). Lastly, a further assure could be that the Fee is required to assessment the US degree of safety and may resolve to droop, amend or repeal the contested choice (para. 58).
Right here, the method of the GC turns into formalistic and theoretical (see González Fuster and Trigo Kramcsák). The case of the independence of the PCLOB is emblematic. The PCLOB is taken into account an unbiased physique as a result of Recital 110 of the choice states so (para. 53) and since “it was conceived, by its founding statute, as an unbiased company” (para. 54). Thus, the GC verified whether or not these our bodies are unbiased solely by adopting a “doc‑based mostly” perspective. Conversely, it didn’t contemplate that the PCLOB is now composed solely of 1 (Republican) member after the Democratic ones had been compelled to depart by President Trump. It’s unknown whether or not the applicant had particularly alleged this reality. Nevertheless, the method within the Schrems instances seems to be extra pragmatic. There, the ECJ referred to the necessity to contemplate not solely “the relevant guidelines in that nation ensuing from its home regulation or worldwide commitments”, but in addition “the apply designed to make sure compliance with these guidelines” (Schrems I, para. 75) and the existence of “efficient unbiased information safety supervision” (e.g. see Schrems II, paras. 103, 181, 188).
Furthermore, in accordance with settled case regulation, the precise to an efficient judicial treatment consists of the precise to know the reasonsupon which the choice relies (see, inter alia, HYA and Others I, para. 46; Minister van Buitenlandse Zaken, para. 43). Nevertheless, the CLPO can not present the complainant with such causes. Certainly, the response to the complainant might be both that “the assessment […] didn’t determine any coated violations” or that the CLPO “issued a willpower requiring applicable remediation”. In each case, the CLPO can not verify or deny whether or not “the complainant was topic to United States alerts intelligence actions” (see Part 3(c)(i)(E) of EO 14086 and Batlle and van Waeyenberge 2023, 196). The identical precept applies to the result of the DPRC attraction process (see Part 3(d)(i)(H) of EO 14086). Arguably, such data shouldn’t be sufficient for the person “to defend [their] rights in the very best circumstances” and “to resolve, with full information of the related details” whether or not to attraction the choice (ZZ, para. 53). Though not analysed by the GC, this level is nonetheless related in assessing whether or not this redress mechanism is ready to overcome the remarks in Schrems II.
To conclude, because the GC repeatedly identified, it’s true that, in accordance with the ECJ, the extent of safety within the third nation doesn’t have to be “similar” however “primarily equal” to the one within the EU. Nevertheless, it doesn’t appear to be potential to argue that our bodies that (1) are probably to not be absolutely unbiased and (2) don’t present the applicant with the grounds of their choices present a degree of safety that’s “primarily equal” to the one set out by Article 47 of the Constitution.
Conclusion
This judgment has typically been celebrated as a “victory” of the EU-US free movement of information after the “defeats” in Schrems I and II. Nevertheless, care must be exercised when seeing Latombe as a as soon as‑and-for-all approval by the CJEU of Resolution (EU) 2023/1795.
Just a few days in the past, Mr Latombe introduced his intention to attraction the judgement earlier than the ECJ. It’s nonetheless unknown which particular grounds of attraction have been raised, and due to this fact unimaginable to make correct predictions on which route the ECJ ruling will take. In keeping with Article 256(1) TFEU, appeals earlier than the ECJ are restricted to factors of regulation and the ECJ can not make findings of reality (see e.g. Autostrada Wielkopolska, paras. 92-93). Thus, it is likely to be laborious to see the ECJ delving into factual issues and fully overturn the GC “formalistic” method. Nonetheless, it has been proven that lots of the vital factors of this judgement are factors of regulation, because the GC arguably departed from the rules said by the ECJ in Schrems I and II.
Lastly, a procedural comment: whereas it comes naturally to check this case to the earlier “saga”, Latombe shouldn’t be Schrems III. The character of direct motion could have been an essential think about shaping the whole case. Whereas in a preliminary reference the questions are formed by the nationwide choose and might be reformulated (and expanded) by the CJEU, right here the GC was strictly certain by the pleas raised by the applicant, which had been fairly slender within the case. This might have performed a task within the total “sectoral” method of the ruling. Thus, whatever the final result of the attraction on this case, different actions – maybe introduced by way of the extra ordinary approach of a preliminary reference – may need a broader scope and, due to this fact, a distinct outcome.
Francesco Bissacco holds a Grasp’s Diploma in Legislation from the College of Padua. His analysis pursuits embody EU regulation, information safety regulation and the enforcement of digital regulation.
The writer wish to sincerely thank Annalisa Volpato for her insightful feedback and recommendations.
