French MP's Appeal Puts EU-US Data Flow Pact Back in Spotlight
An appeal this week of an EU General Court ruling in a case that questioned the EU-U.S. Data Privacy Framework (DPF) will bring the issue to the European Court of Justice (ECJ) again, IAPP officials and privacy lawyers said Thursday. Euractiv reported French Parliament Member Philippe Latombe's appeal Wednesday. Latombe didn't immediately comment.
Sign up for a free preview to unlock the rest of this article
Privacy Daily provides accurate coverage of newsworthy developments in data protection legislation, regulation, litigation, and enforcement for privacy professionals responsible for ensuring effective organizational data privacy compliance.
The General Court tossed Latombe's request for annulment of the DPF (Latombe v. Commission, Case T-533/23) in September (see Ref:2509030001]). In 2023, the European Commission decided that the U.S. adequately protected Europeans' personal data (see Ref:2509040033]). The court agreed with the Commission.
In the September judgment, the General Court was required to consider the validity of the EC decision implementing the DPF at the time it was adopted, in 2023, said Isabelle Roccia, IAPP Managing Director of Europe. "It would be naive to think, however, that a closer examination [of the framework today] -- whether in the form of a legal challenge or as part of the Commission's monitoring duty -- would not consider events since 2023."
Those events include President Donald Trump firing three members of the U.S. Privacy and Civil Liberties Oversight Board (see Ref:2501280044]) in January and the FTC (see Ref:2503190049]).
The court ruling in September validating the legal framework underpinning the DPF was a big win for certainty after two fatal attempts, Roccia said. But Latombe's appeal could trigger an examination of the DPF's workings under the Trump presidency, with findings that could have implications for safeguards that apply across data transfer mechanisms.
There's not much publicly available information about Latombe's appeal yet, but interestingly, the challenge is limited to points of law and can't deal with questions or interpretations of fact, Hogan Lovells privacy attorney Julie Schwartz emailed us Thursday. It can't be based on new elements or new evidence not previously considered by the General Court before Trump took office, making it unclear what the grounds for the appeal are. However, Schwartz added, "It seems difficult to completely disregard the facts."
The General Court noted that the adequacy of the DPF was assessed based on information available at the time of its adoption in 2023. It's hard to imagine the ECJ not taking into consideration how the DPF is working in practice now, she added.
If Latombe's arguments are again rejected, "the message will be strong and will aim to discourage any future attempts to challenge the DPF," Schwartz added.
In addition, there's a lingering question about whether Latombe has the required "standing" to bring the case, IAPP Director of Research and Insights Joe Jones said in an email. But, he added, it's hard to see a scenario where procedure triumphs over the ECJ ruling on the "significant substantive issues of the case: Does the U.S. provide adequate data protection safeguards for EU data?"
While the ECJ follows the rulings of the General Court more often than not, "EU-U.S. data transfers are down 2-0 when it comes to rulings by the highest court," Jones noted. The specter of the DPF being pulled down in the face of the high-stakes trans-Atlantic relationship on the economy and tech "could propel data flows to the very top of the risk register for companies and politicians alike."
"I am not sure [the appeal] is a good idea as the lower court decision is pretty clear, but at least the high court will also have to take a position," said Tanguy Van Overstraeten, a Van Bael & Bellis data and cyber law attorney, in an email to us Thursday.