Data can keep flowing between US, EU as judges confirm privacy pact

THE HAGUE, Netherlands (CN) — A French lawmaker set out to topple Europe’s new data deal with the United States, but the EU’s General Court shot him down, saying the pact gives Europeans enough protection when their personal information crosses the Atlantic.

Philippe Latombe, a French parliamentarian, went to the Luxembourg court hoping to strike down the European Commission’s 2023 decision signing off on the so-called EU–U.S. Data Privacy Framework. In his view, the deal leaves Europeans exposed to U.S. surveillance and tramples on core rights like privacy and access to an independent court.

But on Wednesday the judges turned him down completely, telling Latombe to cover not only his own legal bills but also the commission’s. Ireland, which backed Brussels, and the United States, which joined the case, will pay their own costs. The ruling was immediately available only in French and Portuguese.

A commission spokesperson called the ruling a clear confirmation that the framework is valid.

Europe’s fight over transatlantic data transfers has been running for years. The legal deals that keep information flowing for companies like Google, Meta and Amazon have collapsed twice, first with “Safe Harbor” in 2015 and then with “Privacy Shield” in 2020, after Austrian activist Max Schrems convinced judges that U.S. surveillance laws left Europeans exposed.

To patch things up, Washington rolled out Executive Order 14086 in 2022, tightening the reins on intelligence agencies and setting up the Data Protection Review Court. A year later, the European Commission gave its seal of approval to a new framework — the very one Latombe set out to challenge.

Latombe insisted the U.S. review court wasn’t a real court at all. He pointed out that its judges are chosen by the U.S. attorney general and the body was created by executive order, not Congress. He also warned that American intelligence agencies could still collect data in bulk without strong judicial oversight, and that the system glossed over safeguards against fully automated decisions.

In his view, those flaws meant the Commission had trampled on the EU Charter of Fundamental Rights — which protects privacy, family life and access to justice — as well as the General Data Protection Regulation, or GDPR, Europe’s landmark data-protection law.

Still, the judges brushed aside Latombe’s claims one by one. They said U.S. safeguards don’t need to mirror EU rules word for word, only match them closely enough in practice. They also noted that the review court is made up of independent lawyers serving renewable four-year terms, and that its rulings are binding on American intelligence agencies.

When it came to surveillance, the court stressed that U.S. agencies must use targeted monitoring whenever possible, turning to bulk collection only as a last resort. Executive Order 14086 narrows those bulk programs to national security threats like terrorism, cyberattacks and weapons of mass destruction.

The judges added that the review court can step in afterward to keep those powers in check. As they put it, “It cannot reasonably be argued that the implementation of bulk collection is not regulated in a sufficiently clear and precise manner.”

Not everyone was convinced.

Michael Veale, professor of digital rights and regulation at University College London, said the ruling “contains an array of inconsistencies and questionable assertions that seem likely to resurface if it is appealed to the European Court of Justice.”

He added: “It is surprising that the court considered ex post judicial review sufficient, rather than requiring prior authorization by an independent authority,” a stance he argued puts the judgment out of line with the Court of Justice’s own case law.

Veale also criticized the way the judges handled bulk data and automated decision-making, saying they played down the risks by allowing U.S. authorities to justify collection on grounds like transnational crime and by leaning on weak sectoral rules instead of confronting how major government decisions can rest on large-scale data analysis.

The judges also dismissed the idea that U.S. presidents could quietly widen surveillance powers, pointing out that any changes must usually be published, unless making them public would itself threaten national security.

As for automated decisions, the court described them as rare and already covered by U.S. laws in areas such as credit, housing and employment. It stressed that the few gaps outside Europe’s GDPR are only minor and do not weaken the overall protection.

In the end, the judges made it plain that Latombe’s case had no solid ground. They said that since his claims were unfounded, they could rule on the substance without even weighing admissibility and they went on to dismiss all five of his arguments.

That means the commission’s adequacy decision stands. For now, data can keep flowing between Europe and the United States, a lifeline for countless companies and millions of daily transactions under the 2023 framework.

The decision reassures Brussels and businesses alike.

“The court’s judgment provides stability by upholding the commission’s adequacy decision on the EU–US Data Privacy Framework,” said Karen Mc Cullagh, an associate professor of law at the University of East Anglia.

She noted that the court’s reasoning shows how “bulk collection subject to meaningful ex post oversight” can meet the Charter of Fundamental Rights — the EU’s bill of rights that protects privacy and data protection — giving Brussels a clearer blueprint built on enforceable oversight, independent redress and ongoing monitoring.

Even so, Mc Cullagh warned that “adequacy remains contingent.” She urged companies to see the framework as one lawful option, but to keep standard contractual clauses and transfer impact assessments in their toolkit as a practical backup.

Latombe signaled to media outlets that he will try again in the Court of Justice, the EU’s highest bench. If he does appeal, the case would move to judges in Luxembourg who have the final word on whether the framework can survive legal scrutiny. Any appeal must be filed with the European Court of Justice within two months and 10 days of the judgment.

Latombe did not immediately respond to a request for comment.

Courthouse News reporter Eunseo Hong is based in the Netherlands.