New Landmark Ruling: CJEU's General Court dismisses annulment action targeting the EU-U.S. Data Privacy Framework (DPF) in its entirety

Actualités 4. septembre 2025

Yesterday, the General Court rendered its long-awaited decision on 𝘓𝘢𝘵𝘰𝘮𝘣𝘦 𝘷 𝘊𝘰𝘮𝘮𝘪𝘴𝘴𝘪𝘰𝘯, the third challenge to a transatlantic framework governing personal data transfer from Europe to the U.S., following the invalidation of the adequacy decisions for the Safe Harbor Framework and Privacy Shield in decisions better known as 𝘚𝘤𝘩𝘳𝘦𝘮𝘴 𝘐  and 𝘚𝘤𝘩𝘳𝘦𝘮𝘴 𝘐𝘐, respectively. 

The General Court dismissed the action for annulment of the EU Commission's adequacy decision allowing the adoption and implementation of the DPF for a cross-border transfer of personal data to U.S. participating companies without the necessity to adopt further safeguards or measures (such as standard contractual clauses accompanied by a transfer impact assessment). 

In principle, the General Court based its decision on:

• the independence of the members of the Data Protection Review Court (DPRC) and restrictions on dismissal of and influence on the same;
• the fact that the EU Commission is required to continuously monitor the application of the legal framework on which its adequacy decision is based, i.e., it is the responsibility of the EU Commission to suspend, amend or repeal the contested adequacy decision or limit its scope, as necessary, should such legal framework change; and
• US intelligence agencies' signals intelligence activities (in particular, their bulk collection of personal data) being subject to ex post judicial oversight (a minimum requirement established under Schrems II) by the DPRC. Consequently, the General Court considered that US law does not fail to ensure a level of legal protection essentially equivalent to that guaranteed by EU law.

This decision is highly relevant for Switzerland as well, as following Schrems I and Schrems II, the essentially equivalent frameworks between Switzerland and the U.S. were also invalidated shortly thereafter. Thus, for the time being, both Swiss and EU companies can breathe a sigh of relief.

The following remains to be noted: 

• The decision can still be appealed to the Court of Justice of the CJEU (albeit only as regards points of law).
• The decision relates to the status of U.S. law, the DPF, and its governing bodies at the time of the adoption of the adequacy decision. Following a first (positive) review in 2024, the next review by the EU Commission is currently scheduled for 2027.

The press release of the CJEU is available here.

---

Un article de Leo Rusterholz