Data Protection Authority
The General Court of the European Union dismisses an action for annulment of the new framework for the transfer of personal data between the European Union and the United States
9th September 2025
On the 3rd of September, the General Court of the European Union (ECJ) ruled that the request for annulment of the adequacy decision on the transfer of personal data to the US was rejected.
The case was brought to the court by a French citizen because of transfer of his personal data to the United States. The request was for the annulment of the Commission’s adequacy decision from 2023. The court case was twofold; on the one hand there was a complaint that the Data Protection Review Court (DPRC) was not independent in its work, on the other hand that bulk collection of personal data by intelligence services, without prior approval from the courts or an independent government authority, was not clearly and precisely defined and therefore unlawful.
As regards the DPRC's independence, the Court found that the appointment of judges as well as the functions of the DPRC are protected in order to ensure the independence of the court. It was also observed that the Commission is obliged to monitor the application of the adequacy decision as well as developments in its legal environment in both Europe and the United States. The Commission can therefore decide to repeal and/or amend its adequacy decision if circumstances warrant, such as changes in the legal environment in the United States. In this respect, the Court rejected the argument that the DPRC was not independent in its functions.
The Court also considered that the conclusion of Schrems II does not give reason to conclude that the collection of personal data must necessarily be subject to prior approval by an independent government authority. On the other hand, it is clear that a decision allowing the collection must at least be subject to judicial review. As the collection of personal data by the US intelligence services is subject to review by the DPRC, the Court could not accept that the bulk collection by the US intelligence services does not meet the requirements set out in Schrems II nor that US law does not guarantee adequate legal protection. The claim by the parties to annul the adequacy decision was therefore rejected on those grounds.
No decision has been made on whether the case will be appealed to the Court of Justice of the European Union (ECJ)