The General Court of the European Union recently issued a judgment in Latombe v. European Commission, dismissing the action for annulment of the European Commission’s Decision on the Adequate Level of Protection of Personal Data in the United States (“Adequacy Decision”). The Court thereby confirmed that, at the time of its adoption, the United States ensured an adequate level of protection for personal data transferred from the European Union to organizations in the U.S.

We previously analysed the adoption and significance of the Adequacy Decision in one of our earlier articles. The judgment of the General Court represents the first judicial test of the new framework for the transfer of personal data between the EU and the U.S., confirming its compliance with EU law requirements after years of debate sparked by the Court of Justice of the European Union (“CJEU”) in its landmark Schrems I and Schrems II decisions.

What Preceded the Judgment of the General Court of the EU?

The issue of personal data transfers between the European Union and the United States has long been one of the most contentious topics in the field of privacy protection. After CJEU annulled the Safe Harbour mechanism in its 2015 Schrems I judgment and subsequently invalidated the Privacy Shield framework in Schrems II (2020), the European Commission adopted, on 10 July 2023, a new Decision on the Adequate Level of Protection of Personal Data in the United States. The aim of this Decision was to address the shortcomings previously identified by the CJEU — particularly regarding access by U.S. intelligence agencies to data originating from the EU and the absence of an independent body ensuring effective legal remedies for individuals.

Philippe Latombe, a French Member of Parliament and user of various digital platforms, brought an action before the General Court of the EU seeking annulment of the Decision. He argued that the newly established body — the Data Protection Review Court — lacked sufficient independence and that bulk collection of personal data could still occur without proper judicial oversight.

Judgment of the General Court of the EU

The General Court of the European Union dismissed all the applicant’s claims. In its reasoning, the Court noted that the appointment procedure for the judges of the Data Protection Review Court is accompanied by a set of safeguards ensuring their independence — including limited grounds for dismissal and a prohibition on any interference by the executive branch or intelligence agencies in their work.

The General Court also emphasized that the European Commission is required to continuously monitor the implementation of the new legal framework and, should changes occur in U.S. legislation, it may suspend, amend, or repeal the Adequacy Decision.

As regards the bulk collection of personal data, the General Court held that the Schrems II judgment does not establish an obligation for prior authorization by an independent authority but rather requires the existence of subsequent judicial oversight. Such oversight is exercised precisely through proceedings before the Data Protection Review Court. The General Court concluded that this mechanism ensures a level of legal protection that is essentially equivalent to the standards of EU law.

The Significance of the Judgment for EU Member States and Serbia

In its decision in Latombe v. European Commission, the General Court of the European Union confirmed that the new framework for the transfer of personal data between the EU and the U.S. currently meets the requirements of EU law concerning the adequate level of protection of personal data in the United States. The ruling thus provides institutional support to the European Commission while also clearly reaffirming its obligation to continuously verify whether the U.S. legal framework continues to ensure an equivalent level of protection.

The judgment of the General Court is not yet final, as it may still be appealed before the CJEU. Nevertheless, it already has an important stabilizing effect on cross-border data flows between the EU and the U.S., confirming the current viability of the new mechanism.

Regarding the transfer of personal data between Serbia and the U.S., the Government’s Decision on the List of States, Parts of Their Territories, or One or More Sectors of Certain Activities in Those States and International Organizations in Which an Adequate Level of Protection of Personal Data Is Deemed to Be Ensured (Official Gazette of the Republic of Serbia, No. 55/2019) provides that the transfer of data from Serbia to the U.S. is limited to the Privacy Shield framework. Although this arrangement was invalidated in 2020, the cited Decision has not yet been amended.

Whether the new judgment of the General Court will prompt the Government of Serbia to align the existing Decision with the new framework, and thereby remove any room for divergent interpretations, remains to be seen.

This article is to be considered as exclusively informative, with no intention to provide legal advice. If you should need additional information, please contact us directly.