French legislator Philippe Latombe brought the legal challenge to the EU-US Data Privacy Framework (DPF), which was introduced after two previous agreements were ruled illegal by the EU courts.

In a ruling handed down this morning, the General Court held that the US ensured an adequate level of protection for personal data transferred from the EU to organisations in the US.

Mr Latombe argued that the Data Protection Review Court (DPRC), established by President Joe Biden by means of an executive order in October 2022, was neither impartial nor independent, but reliant on the executive.

However, the court rejected this argument, finding that the appointment of judges to the DPRC and the DPRC’s functioning are accompanied by several safeguards and conditions to ensure the independence of its members.

It observed that judges of the DPRC may be dismissed only by the US attorney general and only for cause, and the attorney general and intelligence agencies may not hinder or improperly influence their work.

If the legal framework in the US changes, the European Commission could respond by suspending, amending or repealing the framework, the court added.

The General Court also rejected arguments around the bulk collection of personal data by American intelligence agencies, which it said are subject to ex post judicial oversight by the DPRC.

Privacy campaigner Max Schrems, who brought the litigation which resulted in the annulment of the two prior EU-US data transfer agreements, said he could bring a further legal challenge.

Commenting on today’s ruling, Mr Schrems said: “This was a rather narrow challenge.

“We are convinced that a broader review of US law — especially the use of executive orders by the Trump administration — should yield a different result.

“We are reviewing our options to bring such a challenge. While the Commission may have gained another year, we still lack any legal certainty for users and businesses.”

He added: “It is clear that the lower court here massively departs from the case law of the CJEU. We are very surprised about this outcome.

“It may be that the General Court did not have sufficient evidence before it — or it wants to make a point to depart from the CJEU. We will have to analyse the ruling in more detail the next days.”