Philippe Latombe – CJEU Judgment (European Union, 2025)
CJEU judgment — not a DPA enforcement action
This is a Court of Justice ruling, not an enforcement action by a data protection authority. It is not included in cookie statistics or the Risk Calculator.
The Court of Justice of the European Union ruled that the US does not provide adequate protection for personal data, leading to the annulment of a previous decision that allowed data transfers to the US. This matters because it affects how companies can handle data across borders. Businesses should stay informed about data transfer regulations to ensure compliance.
What happened
The Court annulled the EU's previous decision that deemed the US as having adequate data protection.
Who was affected
Individuals in the EU whose data is transferred to the US are affected.
What the authority found
The Court found that the US does not meet the necessary standards for protecting personal data, violating Article 45(2) of GDPR.
Why this matters
This ruling emphasizes the need for strong data protection when transferring information internationally. Companies must ensure that they comply with new regulations to avoid legal issues.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
= The Schrems II ruling of the CJEU annulled the Commission’s adequacy decisionCommission Implementing Decision (EU) 2016/1250 of 12 July 2016. that declared that the US offered an equivalent level of protection for personal data. Following the decision, the EU and the US established the Trans-Atlantic Data Privacy Framework (DPF). The DPF is a set of legal acts which, altogether, aim to address the shortcomings in US protection of European data highlighted by Schrems II. In particular, the DPF established: * a Privacy and Civil Liberties Oversight Body (PCLOB) with oversight powers on the activities of intelligence agencies * a Data Protection Review Court (DPRC) with the power to review and overturn the PCLOB’s decisions. Based on the new safeguards introduced with the DPF, the Commission considered that the US offered an adequate level of data protection and adopted a new adequacy decision allowing for data flows ([https://eur-lex.europa.eu/eli/dec_impl/2023/1795/oj/eng Commission Implementing Decision 2023/1795 finding an adequate level of protection ensured by the United States]). The decision allowed EU entities to transfer data to US-based recipients on the basis of Article 45 GDPR (as long as the recipients were certified under the Data Privacy Framework programSee point 2.1.1. of the adequacy decision. A similar limitation was also in place for the Privacy Shield, i.e. the pre-Schrems II data transfer framework.). = In October 2023 French citizen Pierre LatombePhilippe Latombe is a Member of the French Parliament and a Commissioner for the French DPA (CNIL). However, he acted as a private citizen. filed an annulment action with the CJEU against the new adequacy decision from the commission (from now on: ´the adequacy decision´). Contrary to the Commission’s findings, Latombe claimed that the US did not ensure a sufficient level of protection for personal data in the context of third-country data transfers, as required by Article 45(2) GDPR. In particular,
Outcome
CJEU Judgment
A judgment by the Court of Justice of the European Union, typically on a preliminary reference from a national court.
Related Cases (0)
No other cases found for Philippe Latombe in EU
This is the only recorded case for this entity in this jurisdiction.
Details
Judgment Date
3 September 2025
Authority
Court of Justice of the European Union
GDPRhub ID
gdprhub-cjeu-9489About this data
Cite as: Cookie Fines. Philippe Latombe - European Union (2025). Retrieved from cookiefines.eu
Last updated: