The EU–US Data Privacy Framework Upheld at First Instance: Latombe v Commission and the Limits of Adequacy Review

In Latombe v Commission (Case T-553/23), the General Court of the European Union upheld the validity of the EU–US Data Privacy Framework (DPF), dismissing the first direct judicial challenge to the Commission's 2023 adequacy decision. The Court confirmed that the Data Protection Review Court provides sufficient guarantees of independence and impartiality under Article 47 of the Charter of Fundamental Rights, and that bulk collection of personal data by US intelligence agencies satisfies the essentially equivalent standard established in Schrems II, provided it is subject to ex post judicial review. The Court confined its assessment to the factual and legal situation at the time of the adequacy decision's adoption, expressly declining to address post-2023 developments. This note analyses the judgment's principal findings, critically examines the Court's treatment of the temporal scope of review, the ex post review standard, and the Commission's self-monitoring obligation under Article 45(4) GDPR, and assesses the structural fragility the judgment leaves unresolved. Latombe appealed the judgment to the Court of Justice on 31 October 2025 (Case C-703/25 P), raising four grounds of law.