Overview

• The General Court dismissed French lawmaker Philippe Latombe’s bid to annul the 2023 adequacy decision, holding that the United States ensured an adequate level of protection at the time of adoption.
• Judges said U.S. signals intelligence is subject to ex post review by the Data Protection Review Court and noted safeguards intended to secure the DPRC’s independence.
• The court rejected arguments that bulk collection requires prior authorization by a court or independent authority, finding that post hoc oversight satisfies EU case law.
• The ruling offers near‑term legal certainty for transatlantic data transfers, allowing self‑certified companies under the DPF to continue operations without switching to alternative mechanisms.
• An appeal to the Court of Justice of the European Union can be filed within two months, privacy advocates such as Max Schrems are weighing further action, and the European Commission must keep monitoring and can suspend or amend the framework if U.S. rules change.