Update (30 October 2026): As at the date of this update, no hearing or Advocate General's opinion has been announced in the C-703/25 P appeal, and we are not aware of any published Commission response to the EDPB's July 2026 letter. The DPF remains in force.
On 3 September 2025, the EU General Court threw out the first direct challenge to the EU–US Data Privacy Framework. Transatlantic transfer optimists celebrated. They should read the judgment again — because the way the court won the case for the Commission quietly mapped every route to losing the next one.
The case, briefly
Philippe Latombe, a member of the French Parliament suing in his personal capacity as a user of US platforms, asked the General Court to annul Commission Implementing Decision (EU) 2023/1795 — the adequacy decision underpinning the EU–US Data Privacy Framework (DPF). His two central attacks went to the heart of the post-Schrems II architecture: that the Data Protection Review Court (DPRC), the redress body created for EU data subjects, is not an independent and impartial tribunal because it sits inside the executive branch; and that bulk collection of EU personal data in transit by US intelligence agencies is unlawful because it occurs without prior authorization by a court or independent authority and is insufficiently circumscribed.
In Case T-553/23 (ECLI:EU:T:2025:831), the Tenth Chamber, Extended Composition, dismissed the action on the merits. The DPRC's safeguards were held sufficient, and the court distinguished the CJEU's La Quadrature du Net line and the ECtHR's Big Brother Watch on bulk collection, accepting ex post oversight in place of prior authorization for the surveillance at issue. The DPF survived its first judicial test — a first for any EU–US transfer framework, after Safe Harbour and Privacy Shield both died in court.
So why call it a paradox? Because three features of the victory each made the framework structurally weaker.
Paradox one: the standing door was left wide open
The Commission argued the case should never have been heard: individuals face a notoriously high bar (the Plaumann test) to show that an EU act is of direct and individual concern to them. The General Court expressly declined to rule on admissibility, proceeding straight to the merits in the interests of the sound administration of justice.
That procedural courtesy has consequences. Schrems I and II reached Luxembourg the slow way — an individual complaint, a national authority, a national court, a preliminary reference — a journey of years. Latombe demonstrated a shortcut: a direct annulment action filed by one motivated individual, adjudicated at first instance without the standing question ever being resolved against him. As Freshfields observed in its 2026 data-trends analysis, the case revealed low procedural barriers for challenging adequacy decisions. The court won this battle while publishing the enemy's map of the terrain: any future adequacy decision — for the US, the UK, Japan, or the next candidate — now faces a cheaper, faster attack route whose main defensive gate was never closed.
Paradox two: the court validated 2023, not today
The General Court confined its review to the legal and factual situation at the time the adequacy decision was adopted — July 2023 — expressly declining to consider later developments. Commentators noted the tension with earlier case law suggesting adequacy must be assessed against the current situation, and academic analysis has flagged the temporal scope of review as the judgment's central unresolved weakness.
Consider what that timing choice excludes. Since July 2023: the Privacy and Civil Liberties Oversight Board was hollowed out when its Democratic members were dismissed in January 2025; and on 29 June 2026, the US Supreme Court held in Trump v. Slaughter that FTC commissioners are removable at presidential will — dissolving the statutory independence of the very agency the adequacy decision repeatedly invokes as the DPF's commercial enforcer (noyb counts 259 references). The EDPB wrote to the Commission on 31 July 2026 asking it to closely assess whether the FTC remains independent enough to underpin adequacy.
The judgment therefore certifies a snapshot of a legal order that no longer exists. Far from settling the question of US adequacy, the time-of-adoption logic shifts the live battlefield to two places the judgment cannot reach: the Commission's continuous monitoring duty under Article 45(4) GDPR — which now sits uncomfortably alongside the EDPB's formal request — and any fresh challenge built on post-2023 facts, which arrives at court unburdened by the Latombe precedent.
Paradox three: the appeal turned a shield into a delivery mechanism
Latombe appealed on 31 October 2025 (Case C-703/25 P), raising four grounds of law, with the Commission defending and Ireland and — notably — the United States, both interveners at first instance, also party to the proceedings; Microsoft has since been granted leave to intervene in support of the Commission. Appeals to the Court of Justice are limited to points of law and typically take eighteen months or more, which places a decision in 2027 at the earliest: precisely when the Court will be unable to ignore the post-Slaughter landscape, whatever the formal temporal frame. The first-instance win thus guarantees that the DPF's fate will be decided by the same court that killed Safe Harbour and Privacy Shield, at the worst possible moment in the underlying facts. And the blast radius extends beyond the DPF itself: the UK's US "data bridge" was adopted on the strength of the EU adequacy conclusion, and noyb argues that SCC- and BCR-based transfers rest on the same assessment of US law — so there is no clean fallback that escapes the question.
What prudent exporters should take from this
The DPF remains fully valid today, and certified transfers may continue — nothing in Latombe, Slaughter, or the EDPB's letter changes the current legal position. But the risk profile has inverted: the danger is no longer that a court finds the 2023 framework inadequate, it is that the 2023 framework has visibly drifted from the 2026 facts, with three separate fuses burning — the C-703/25 P appeal, the Commission's Article 45(4) review pressure, and fresh litigation that noyb has already announced. Practically, that argues for treating the DPF as a mechanism with a contingency attached: know which of your vendor transfers rely on it (directly or via the UK bridge), keep SCCs plus a current transfer impact assessment warm as the fallback — with honest documentation of the post-Slaughter US analysis — and build data-flow maps now rather than in the week after a Luxembourg press release. How to run that assessment without descending into either paranoia or paperwork is the subject of the companion post in this series.
The General Court handed the Commission a victory in September 2025. It may prove to be the kind of victory that loses the war on schedule.
Sources and further reading
- General Court, Case T-553/23 Latombe v Commission, judgment of 3 September 2025 (ECLI:EU:T:2025:831); appeal pending as Case C-703/25 P (notice in the Official Journal)
- European Law Blog, Case T-553/23 Latombe: Overturning Schrems… and Plaumann?
- EU Law Analysis, The General Court of the European Union upholds the Data Privacy Framework
- eucrim, General Court Confirms Adequacy of U.S. Data Protection
- Freshfields, Rising risks and shifting rules for international data transfers
- noyb, US Supreme Court just blew up EU-US Data Transfers
- IAPP, EDPB requests review of EU-US Data Privacy Framework following Trump v. Slaughter
- Sheppard Mullin, Trump v. Slaughter: Future Hurdles for DPF-Based EU and UK Data Transfers to the US?
This post is general commentary, not legal advice. Specific transactions or transfers should be reviewed by qualified counsel in the relevant jurisdictions.