Latombe v. Commission: The Challenge to the EU-US Data Privacy Framework
A French MP took the EU-US Data Privacy Framework to court, lost at first instance in September 2025 and appealed to the CJEU (C-703/25 P). The case in plain language, its current status and sources.
Last checked: October 27, 2026. Each procedural step below links to a source; the log at the end records what changed and when.
If the EU-US Data Privacy Framework (DPF) falls, the case to watch is Latombe v. Commission. It is the challenge most likely to produce the ruling the industry has pre-named "Schrems III" ↗, and it is pending before the EU's highest court.
Status today
The DPF is in force. The European Commission adopted it on July 10, 2023, and transfers to US companies certified under it, Google included, are lawful. One appeal against it is pending before the Court of Justice of the EU (CJEU). On October 27, 2026 we found no hearing date or Advocate General opinion announced for it.
| Case | C-703/25 P, appeal against the General Court judgment in T-553/23 |
| Court | Court of Justice of the European Union |
| Filed | October 31, 2025 (WilmerHale, December 1, 2025) |
| Status | Pending |
| Case file | CJEU case search, C-703/25 |
Who is Philippe Latombe?
A French member of parliament with a long record on digital sovereignty. Max Schrems attacked the two previous frameworks through complaints against Facebook that went up through national courts. Latombe went straight at the target: in September 2023, two months after the Commission adopted the DPF, he asked the EU General Court to annul it (case T-553/23). His request to suspend the framework while the case ran was rejected in October 2023.
That procedural choice matters. A direct action skips years of national proceedings, but standing is harder to win, and it frames the question narrowly: did the Commission act lawfully when it found that the US offers adequate protection for EU personal data?
What he argued
- The redress body is not a real court. The DPF's answer to the defects identified in Schrems II is the Data Protection Review Court, where people in the EU can challenge US surveillance of their data. Latombe argued it is not independent in the way EU law requires: it sits inside the US executive branch, rests on an executive order any administration can amend, and keeps the complainant in the dark.
- US bulk collection remains disproportionate. The objection that sank Safe Harbor and Privacy Shield: bulk collection by US intelligence agencies is incompatible with EU proportionality requirements.
- Procedural defects, including that the decision was published only in English at adoption.
What the General Court decided (September 3, 2025)
The General Court dismissed the action and upheld the DPF. It found that the Data Protection Review Court offers sufficient guarantees of independence, that bulk collection is adequately limited by the safeguards in place, and that the Commission stayed within its margin of assessment. It ruled on the merits without deciding whether Latombe had standing.
Max Schrems' organization noyb reacted the same day that it was "very surprised about this outcome" and would analyse the ruling (quoted by Lewis Silkin).
Two reasons the first judgment is not the end. The General Court is the lower court; the CJEU above it is the court that struck down Safe Harbor in 2015 and Privacy Shield in 2020. And the judgment rests on the current US executive orders, which can change without any court moving.
What the appeal can change
The CJEU reviews points of law, not facts: the fight is over whether the General Court applied the right standard for independence, redress and proportionality, the ground on which the CJEU was strictest in both Schrems judgments. Nobody can give a reliable date for its decision.
- Appeal dismissed: the DPF stands until its next periodic review by the Commission, and transfers under it stay lawful.
- Appeal succeeds: the adequacy decision falls, transfers relying on it lose their basis, and regulators can return to the reasoning of their 2022 decisions against Google Analytics ↗.
- A new challenge elsewhere: a separate case, by noyb or anyone else, would run on its own clock.
What it means for your analytics stack
Nothing changes today: the DPF is valid, and Google Analytics is lawful to use under it. The case defines a risk, and the cheap insurance is the same whatever the outcome: list the tools that send visitor data to US companies, keep your analytics history exportable, and prefer tools whose default mode collects little and stores it in the EU ↗.
Our angle, stated plainly: Datalenk is published by a French company and keeps its servers and databases in the European Union (Hetzner), so the appeal has little bearing on the analytics layer of our customers' stack. We do use US vendors, for our own operations (Cloudflare as CDN, Stripe for billing, Amazon SES for email) and for an optional AI analysis that sends aggregated figures to Anthropic when you click it; they are named on our sub-processors page, which is why we tell people to inventory every tool, not just analytics.
Log
- 2026-10-27: Checked. C-703/25 P still pending; no hearing date or Advocate General opinion found. The separate tracker page is merged into this one. Sources added for each step; the decision window we used to give (2027-2028) is removed, because nothing supports a date.
- 2026-07-11: Checked. C-703/25 P pending, no hearing date announced.
- 2026-06-12: First version of the tracker.
FAQ
What is Latombe v. Commission? A direct challenge to the EU-US Data Privacy Framework filed by French MP Philippe Latombe in September 2023 (T-553/23). The EU General Court dismissed it on September 3, 2025; Latombe appealed to the CJEU on October 31, 2025 (C-703/25 P).
Did the court find the Data Privacy Framework valid? The General Court did. The appeal before the Court of Justice, the court that invalidated both previous frameworks, is pending.
When will the CJEU rule? No date has been announced. We will add it to the log above when one is.
Is this the same thing as Schrems III? "Schrems III" is the industry nickname for whatever ruling next decides the DPF's fate. The Latombe appeal is the case pending now.
Should I stop using Google Analytics because of this case? Not on legal grounds today. The case measures a real risk, and sites that prepared before the 2020 and 2022 decisions had a much cheaper transition than sites that scrambled after them.