General Court of the European Union — European Commission

Decided by

General Court

Parties

Philippe Latombe v. European Commission

Decision date

September 3, 2025

Remedy

The General Court dismissed the action for annulment in its entirety and ordered Philippe Latombe to pay the costs incurred by the European Commission.

Appeal

Appeal status not stated

Key holdings

1. The guarantees established for the Data Protection Review Court ensure an independent and impartial review of decisions issued by the Civil Liberties Protection Officer.

   “the guarantees provided for by Executive Order 14086 as regards the functioning and powers of the DPRC allow an independent and impartial review of the decisions adopted by the CLPO.” — paragraph 46

2. Decisions rendered by the Data Protection Review Court are final and legally binding on both the United States Government and its intelligence agencies.

   “In addition, whatever decision is adopted by the DPRC, it is binding and final. Both the intelligence agencies and the United States Government are therefore required to comply with it.” — paragraph 45

3. Section 702 of the Foreign Intelligence Surveillance Act governs targeted collection rather than bulk collection of personal data and is irrelevant to claims against bulk collection.

   “It follows that, as Section 702 of the FISA is not concerned with bulk collection of personal data, it has no relevance in the present case.” — paragraph 90

4. The data protection framework's security obligations adequately encompass consultation of transferred personal data by recipient organizations.

   “It follows that the applicant’s argument that no security measure is required in the contested decision when DPF organisations consult personal data originating in the European Union is unfounded.” — paragraph 203

In plain English

Philippe Latombe, a French citizen, brought an action before the General Court of the European Union seeking the annulment of Commission Implementing Decision (EU) 2023/1795 of 10 July 2023. This adequacy decision established the EU-U.S. Data Privacy Framework, enabling personal data to be transferred from the European Union to certified organizations in the United States. Latombe claimed that the decision violated EU data protection rights, fundamental privacy rights, fair trial guarantees, rules on automated decision-making, and security processing obligations under the General Data Protection Regulation. The General Court dismissed the action in its entirety on 3 September 2025. Addressing the right to an effective remedy, the court held that the newly created Data Protection Review Court provides an independent and impartial review mechanism, as its judges are protected from removal without cause and its decisions are final and binding on US intelligence agencies. Regarding bulk collection of signals intelligence, the court found that US law contains clear safeguards and ex post judicial review, satisfying essential equivalence standards without requiring prior administrative or judicial authorization. Furthermore, the court determined that sectoral US privacy laws adequately complement General Data Protection Regulation provisions regarding automated decision-making and that the framework's security principles adequately cover data consultation. Consequently, the court upheld the validity of the Commission Implementing Decision and ordered Latombe to pay the costs.