Philippe Latombe – CJEU Judgment (European Union, 2025)
CJEU judgment — not a DPA enforcement action
This is a Court of Justice ruling, not an enforcement action by a data protection authority. It is not included in cookie statistics or the Risk Calculator.
= The Schrems II ruling of the CJEU annulled the Commission’s adequacy decisionCommission Implementing Decision (EU) 2016/1250 of 12 July 2016. that declared that the US offered an equivalent level of protection for personal data. Following the decision, the EU and the US established the Trans-Atlantic Data Privacy Framework (DPF). The DPF is a set of legal acts which, altogether, aim to address the shortcomings in US protection of European data highlighted by Schrems II. In particular, the DPF established: * a Privacy and Civil Liberties Oversight Body (PCLOB) with oversight powers on the activities of intelligence agencies * a Data Protection Review Court (DPRC) with the power to review and overturn the PCLOB’s decisions. Based on the new safeguards introduced with the DPF, the Commission considered that the US offered an adequate level of data protection and adopted a new adequacy decision allowing for data flows ([https://eur-lex.europa.eu/eli/dec_impl/2023/1795/oj/eng Commission Implementing Decision 2023/1795 finding an adequate level of protection ensured by the United States]). The decision allowed EU entities to transfer data to US-based recipients on the basis of Article 45 GDPR (as long as the recipients were certified under the Data Privacy Framework programSee point 2.1.1. of the adequacy decision. A similar limitation was also in place for the Privacy Shield, i.e. the pre-Schrems II data transfer framework.). = In October 2023 French citizen Pierre LatombePhilippe Latombe is a Member of the French Parliament and a Commissioner for the French DPA (CNIL). However, he acted as a private citizen. filed an annulment action with the CJEU against the new adequacy decision from the commission (from now on: ´the adequacy decision´). Contrary to the Commission’s findings, Latombe claimed that the US did not ensure a sufficient level of protection for personal data in the context of third-country data transfers, as required by Article 45(2) GDPR. In particular,
GDPR Articles Cited
= The Schrems II ruling of the CJEU annulled the Commission’s adequacy decisionCommission Implementing Decision (EU) 2016/1250 of 12 July 2016. that declared that the US offered an equivalent level of protection for personal data. Following the decision, the EU and the US established the Trans-Atlantic Data Privacy Framework (DPF). The DPF is a set of legal acts which, altogether, aim to address the shortcomings in US protection of European data highlighted by Schrems II. In particular, the DPF established: * a Privacy and Civil Liberties Oversight Body (PCLOB) with oversight powers on the activities of intelligence agencies * a Data Protection Review Court (DPRC) with the power to review and overturn the PCLOB’s decisions. Based on the new safeguards introduced with the DPF, the Commission considered that the US offered an adequate level of data protection and adopted a new adequacy decision allowing for data flows ([https://eur-lex.europa.eu/eli/dec_impl/2023/1795/oj/eng Commission Implementing Decision 2023/1795 finding an adequate level of protection ensured by the United States]). The decision allowed EU entities to transfer data to US-based recipients on the basis of Article 45 GDPR (as long as the recipients were certified under the Data Privacy Framework programSee point 2.1.1. of the adequacy decision. A similar limitation was also in place for the Privacy Shield, i.e. the pre-Schrems II data transfer framework.). = In October 2023 French citizen Pierre LatombePhilippe Latombe is a Member of the French Parliament and a Commissioner for the French DPA (CNIL). However, he acted as a private citizen. filed an annulment action with the CJEU against the new adequacy decision from the commission (from now on: ´the adequacy decision´). Contrary to the Commission’s findings, Latombe claimed that the US did not ensure a sufficient level of protection for personal data in the context of third-country data transfers, as required by Article 45(2) GDPR. In particular,
Outcome
CJEU Judgment
A judgment by the Court of Justice of the European Union, typically on a preliminary reference from a national court.
Related Cases (0)
No other cases found for Philippe Latombe in EU
This is the only recorded case for this entity in this jurisdiction.
Details
Judgment Date
3 September 2025
Authority
Court of Justice of the European Union
GDPRhub ID
gdprhub-cjeu-9489About this data
Cite as: Cookie Fines. Philippe Latombe - European Union (2025). Retrieved from cookiefines.eu
Last updated: