Headlines
EU court backs latest data transfer deal agreed by US and EU
Published by Global Banking & Finance Review®
Posted on September 3, 2025
3 min readLast updated: January 22, 2026
Global Banking & Finance Review®
Company
Published by Global Banking & Finance Review®
Posted on September 3, 2025
3 min readLast updated: January 22, 2026
The EU court has approved the EU-US data transfer agreement, ensuring legal certainty for companies transferring data across the Atlantic.
By Foo Yun Chee and Sudip Kar-Gupta
BRUSSELS (Reuters) -A data transfer deal agreed by the European Union and the United States two years ago to replace two previous pacts rejected by a higher tribunal was given the green light by Europe's second-highest court on Wednesday.
The ruling will provide legal certainty to thousands of companies, ranging from banks to tech companies to drugmakers and car manufacturers, that transfer personal data across the Atlantic for commercial use such as payroll purposes and cloud infrastructure.
The case comes at a time of tension in EU-U.S. relations following an EU crackdown on Big Tech and threats of retaliation by U.S. President Donald Trump.
The European Commission, which negotiated the accord on behalf of the 27 EU member states in 2023, had said it offered an adequate level of protection for Europeans' personal data transferred to the U.S.
French lawmaker Philippe Latombe subsequently sued the EU executive, saying there were inadequate guarantees of respect for private and family life in the agreement because of the widespread and bulk collection of personal data.
He criticised the new U.S. appeal body to which Europeans could resort, saying it was not an independent tribunal and did not offer guarantees similar to those required by EU law.
The Luxembourg-based General Court sided with the Commission.
"The General Court dismisses an action for annulment of the new framework for the transfer of personal data between the European Union and the United States," it said in a ruling.
"On the date of adoption of the contested decision, the United States of America ensured an adequate level of protection for personal data transferred from the European Union to organisations in that country."
Judges dismissed privacy concerns about U.S. surveillance.
"In the present case, it is apparent from the file that, under U.S. law, signals intelligence activities carried out by US intelligence agencies are subject to ex post judicial oversight by the DPRC," they said, referring to the U.S. Data Protection Review Court.
Latombe can appeal to the Court of Justice of the European Union (CJEU) - Europe's highest - on matters of law.
The CJEU scuppered the previous two deals after challenges by Austrian privacy activist Max Schrems because of concerns about U.S. intelligence agencies' accessing European citizens' private data.
Schrems said he still had concerns about the pact despite the ruling, suggesting a broader review of U.S. law would yield "a different result".
The case is T-553/23 - Latombe v Commission.
(Reporting by Foo Yun Chee and Sudip Kar-Gupta, Editing by Timothy Heritage)
The EU court validated a data transfer deal between the EU and the US that had been negotiated by the European Commission, providing legal certainty for companies transferring personal data.
Philippe Latombe criticized the agreement for lacking adequate guarantees for private and family life, particularly regarding U.S. surveillance practices.
Latombe has the option to appeal to the Court of Justice of the European Union (CJEU) on matters of law concerning the ruling.
The previous two data transfer agreements were invalidated by the CJEU due to concerns over U.S. intelligence agencies accessing European citizens' private data.
The General Court stated that the U.S. ensured an adequate level of protection for personal data transferred from the EU, dismissing privacy concerns related to U.S. surveillance.
Explore more articles in the Headlines category
