Case C-703/25 P: Appeal brought on 31 October 2025 by Philippe Latombe against the judgment of the General Court (Tenth Chamber, Extended Composition) delivered on 3 September 2025 in Case T-553/23, Latombe v Commission
Date: 2025-10-31
Institutions: Court of Justice
Subjects: United States, cross-frontier data flow, data protection, exchange of information, independence of the judiciary, personal data, protection of privacy








C_202506610EN.000101.fmx.xml












Official Journal of the European Union


EN
C series













C/2025/6610


22.12.2025






Appeal brought on 31 October 2025 by Philippe Latombe against the judgment of the General Court (Tenth Chamber, Extended Composition) delivered on 3 September 2025 in Case T-553/23, Latombe v Commission


(Case C-703/25 P)

(C/2025/6610)
Language of the case: French

Parties


Appellant: Philippe Latombe (represented by: J.-B. Soufron and T. Lamballe, avocats)

Other parties to the proceedings: European Commission, Ireland, United States of America

Form of order sought

The appellant claims that the Court should:






—


Principally:






—


set aside the judgment of the General Court of the European Union of 3 September 2025 in Latombe v Commission (T-553/23; ‘the judgment under appeal’, ECLI:EU:T:2025:831); and










—


ruling in place of that court under Article 170(1) of the Rules of Procedure of the Court of Justice, grant the form of order sought at first instance and, consequently, annul Commission Implementing Decision (EU) 2023/1795 of 10 July 2023, finding, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council, that an adequate level of protection of personal data is ensured under the EU-US Data Privacy Framework (OJ 2023 L 231, p. 118, ‘the DPF adequacy decision’);














—


In the alternative:






—


set aside the judgment under appeal; and










—


refer the case back to the General Court;














—


In any event, order the Commission to pay the costs.





Grounds of appeal and main arguments

In support of his appeal, the appellant relies on four grounds.

First ground of appeal

The first ground of appeal alleges that the General Court made a manifest error of assessment, erred in law, failed to state sufficient reasons and distorted the evidence in the case file in rejecting the plea in law in the application alleging infringement of the second paragraph of Article 47 of the Charter of Fundamental Rights of the European Union and of Article 45(2) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1, ‘the GDPR’), on the ground that the rules for appointing and dismissing the judges of the Data Protection Review Court (‘the DPRC’) do not call those safeguards into question.

Second ground of appeal

The second ground of appeal alleges that the General Court erred in law in holding that, in order to assess whether the requirements under the second paragraph of Article 47 of the Charter of Fundamental Rights are satisfied, it is sufficient to determine whether the text establishing a tribunal and defining its operating rules provides for sufficient safeguards to ensure its independence and its impartiality as regards other powers, including the executive, and that it is not necessary to assess the formal nature of that text in order to reject the second part of the third plea in law in the application, according to which the DPF adequacy decision infringes the second paragraph of Article 47 of the Charter of Fundamental Rights and Article 45(2) of the GDPR because the DPRC is not a tribunal previously established by law.

Third ground of appeal

The third ground of appeal alleges that the General Court’s decision is vitiated by three errors of law made by the General Court in order to reject the second part of the second plea in law in the application, according to which the DPF adequacy decision infringes Articles 7 and 8 of the Charter of Fundamental Rights because United States law does not render bulk collection of personal data subject to prior authorisation by a judicial or administrative authority, claiming that because:






(i)


first, the General Court was wrong to hold that nothing in the judgment of 16 July 2020, Facebook Ireland and Schrems (C-311/18, EU:C:2020:559), suggests that the bulk collection of personal data must necessarily be subject to prior authorisation issued by an independent authority and that, on the contrary, it is apparent from that judgment that it is sufficient for the decision authorising bulk collection to be subject only to an ex post facto judicial review;










(ii)


second, the General Court was also wrong to hold that the references to the outcomes adopted by the judgments of the Court of Justice of 6 October 2020, La Quadrature du Net and Others (C-511/18, C-512/18 and C-520/18, EU:C:2020:791), and of 30 April 2024, La Quadrature du Net and Others (Personal data and action to combat counterfeiting) (C-470/21, EU:C:2024:370), are irrelevant;










(iii)


last, the General Court was also wrong to hold that it cannot be concluded that the fact that there is no requirement for prior authorisation applying to initial bulk collection, by the United States intelligence agencies, of personal data in transit from the European Union is sufficient to support a finding that, in the light of the lessons to be drawn from the judgment of the ECtHR of 25 May 2021, Big Brother Watch and Others v. the United Kingdom (CE:ECHR:2021:0525JUD005817013), the law of the United States of America does not provide safeguards essentially equivalent to those provided for by EU law.





Fourth ground of appeal

The fourth ground of appeal alleges that the General Court’s decision is vitiated by contradictory reasoning and an error of law because the General Court holds that it cannot be found that the power conferred on the President of the United States to update the list of specific objectives of bulk collection is contrary to the requirements identified by the ECtHR in the judgment of the ECtHR of 4 December 2015, Roman Zakharov v. Russia (CE:ECHR:2015:1204JUD004714306), in order to reject the third part of the second plea in law, according to which the DPF adequacy decision infringes Articles 7 and 8 of the Charter of Fundamental Rights because Executive Order 14086 of 7 October 2022 gives the President of the United States power to authorise a secret update of the specific obligations relating to bulk collection.


ELI: http://data.europa.eu/eli/C/2025/6610/oj
ISSN 1977-091X (electronic edition)