Op-Ed: “The Challenge to EU-US Data flows Before The General Court in Latombe (T-553/23): On Light-Touch Scrutiny and Low-Level Review”

The recent General Court decision in Latombe (T-553/23) continues a short but high-profile line of case law on the question of checks and balances in EU-US data transfers, which are among the world’s most significant economically and politically. It was the third time the ‘adequacy’ of an EU-US data transfer agreement was assessed by the EU's highest courts in the last 10 years, with the first two challenges invalidating the EU-US Safe Harbor Framework in 2015 and the EU-US Privacy Shield in 2020. After the Court of Justice struck down the EU-US Privacy Shield in Schrems II (C-311/18), the EU and the US took some time to agree on a way forward that would enable data to flow safely in one of the world’s largest data transfer regimes. This included an agreement after much negotiation to include a ‘transatlantic court’ – a so-called Data Protection Review Court (DPRC) – and independent oversight. These steps were taken to enable an adequacy decision under Regulation 2016/679. No such ‘court’ exists with any other EU-third country partners with adequacy decisions, and its nomenclature proved challenging from day one. The development of this ‘court’ had been supported by a highly EU-disposed US Biden administration, keen to engage with EU law concerns as well as US law.