On November 5, 2025, the Cross-Border Data Forum (CBDF) hosted a panel moderated by DeBrae Kennedy-Mayo (Research Faculty Member at the Georgia Tech Scheller College of Business and Senior Fellow at CBDF), featuring experts Theodore Christakis (Professor of International and European Law at the Université Grenoble Alpes and European Research Director at CBDF), Joe Jones (Director of Research & Insights at the IAPP and Senior Fellow at CBDF), and Kenneth Propp (Adjunct Professor of European Union Law at the Georgetown University Law Center and Senior Fellow at CBDF).
The discussion focused on the EU General Court’s decision in the Latombe case (rendered on September 3, 2025), examining the legal issues raised–both procedural and substantive–its implications for EU-U.S. data transfers, and what to expect from Latombe’s appeal challenging the ruling.
Episode Highlights:
[00:00] – Introduction and presentation of the experts
[02:52] – Joe Jones’ analysis of the key elements of the EU General Court’s decision on the Latombe case
[06:03] – Joe Jones on the EU General Court’s oversight analysis and U.S. data access authorization
[09:55] – Theodore Christakis’ insights on the Latombe appeal and on why the CJEU should examine first the major issue of admissibility
[16:23] – Joe Jones’ perspective on appeal timing and outcomes
[21:32] – Kenneth Propp’s analysis of the standing argument and the Court of Justice’s appeal decision
[24:46] – Theodore Christakis’s perspective on why the CJEU should declare Latombe’s appeal inadmissible for lack of standing
[33:02] – Joe Jones’ analysis on how other EU decisions (including Bindl v. European Commission) may impact the Latombe case
[39:22] – Kenneth Propp on the impact of the Latombe case in the U.S.
[45:30] – Theodore Christakis’s analysis of the fate of the EU-U.S. DPF
[51:00] – Closing insights from Kenneth Propp and Joe Jones
[56:00] – Questions from the audience
Quotes:
Joe Jones: “On both of [the assessment of the collection of data by U.S. law enforcement authorities and the redress mechanism made available to EU individuals], the Court really does cleave very closely to the European Commission’s findings. (…) The judgment sticks very closely to the Commission’s own findings. That’s notable.”
Joe Jones: “It is significant that the EU Court has looked into and taken inspiration from the European Court of Human Rights [a court of a different legal order] and has given effectively the U.S.–but principally the European Commission through its own assessment–the wide margin of appreciation [that is usually granted by the European Court of Human Rights to member states].”
Theodore Christakis: “Legally, the General Court based this move on a precedent called Council v Boehringer. This precedent gives the trial court discretion to dismiss a case on its substance, without first ruling on a complex admissibility challenge, in the name of “the proper administration of justice”—which is usually interpreted as “judicial economy”. Boehringer is a tool for obvious cases, where the merits are manifestly weak and quicker to dismiss than a thorny admissibility analysis. In Latombe, by contrast, the GC issued a long, complex merits judgment. That looks less like “economy” and more like extending the shortcut into a strategic route to reach substance in a high-salience case”.
Theodore Christakis: “The Court’s use of it here is a “paradox of judicial economy”. The Court embarked on a 188-paragraph, highly complex analysis of the merits, involving comparative US constitutional law, the structure of US intelligence, and fundamental rights. This was demonstrably less efficient and created far more work for the Court, not less. The General Court appears to have made a strategic choice to “fast-track” the case to a substantive judgment, prioritizing “immediate substantive finality” for a matter of immense political and economic importance, rather than following the correct procedural order”.
Theodore Christakis: “It is highly improbable, for the CJEU to do the same on appeal. The two courts have fundamentally different roles. Most importantly, the conditions for admissibility—like locus standi, or standing—are not mere technicalities. In EU law, they are considered matters of “public policy” (ordre public). This means they are fundamental rules about the Court’s jurisdiction that cannot be waived or ignored. The CJEU is not only empowered but obligated to raise these issues of its own motion (proprio motu), even if the parties don’t”.
Joe Jones: “Prior to a [CJEU] judgment, [there can be] a non-binding opinion of the advocate general. (…) They’re often viewed as influential, but they are not binding. More often than not, the Court of Justice follows the outcome if not the entire reasoning of the advocate general. I will say that ‘more often that not’ does not seem to be true in data protection cases. And it is certainly not true in these international data transfer cases, where we’ve seen the judges actually do a 180 on the advocate general ruling.”
Joe Jones: “[I think the CJEU] will see its role as a guardian in applying the fundamental right to data protection and privacy. And it will say, just as the General Court said, that this is a big deal, and we’re not ready to just dismiss this because Mr. Latombe does not have standing. In fact, the irony would be, if a number of the [EU] Member States intervene, if private parties intervene, I think that this will just encourage, if anything, the CJEU to say ‘look, this is clearly a significant substantive issue, and we’re not able to just relegate this issue to standing’. So I see [the CJEU] going to the merits.”
Kenneth Propp: “Luxembourg is a long way from Brussels. (…) The CJEU prides itself on its independence from political considerations. I think [the Court] will be eager to take on the merits. But at the same time, that brings risk with it. And the Court will know that. (…) The Court will be unavoidably aware of the risks of another data protection crisis between the EU and the U.S.”
Theodore Christakis : “The CJEU will likely declare the appeal inadmissible because the applicant fails to meet the strict standing requirements for individuals challenging general EU acts. Mr. Latombe cannot satisfy the traditional Plaumann test for “individual concern” because his status as a data subject does not differentiate him from millions of other users, making this an inadmissible actio popularis”.
Theodore Christakis: “The “regulatory act” exception also fails on the grounds of “direct concern.” Because the Data Privacy Framework is permissive rather than mandatory, companies retain the discretion to use other transfer mechanisms or localize data; this discretionary commercial choice breaks the automatic causal link required by the Court, rendering any potential harm contingent rather than direct”.
Theodore Christakis: “The key difference with Schrems I and II cases is procedural, and it’s what the Court calls the “complete system of legal remedies”. Max Schrems did not challenge the frameworks directly in Luxembourg. Instead, he filed a complaint with his national data protection authority in Ireland. This led to a case in the Irish national courts. That Irish court then used the preliminary reference procedure to ask the CJEU in Luxembourg, “Is this EU adequacy decision valid?”. This “indirect” route is the one the Treaties provide and which is appropriate for such cases. By choosing to sue directly, Mr. Latombe must clear high procedural hurdles”.
Theodore Christakis: “If the CJEU finds the original action inadmissible, it is formally declaring that the EU courts have no legal authority to hear the dispute. Any subsequent pronouncement on the merits would be an ultra vires act. There is absolutely no precedent of a case where the Court of Justice declared a case inadmissible but also made a pronouncement on the merits. If the Court does this [in the Latombe case], it will be a very bad administration of justice. It will give a disguised advisory opinion, which is illegal.”
Joe Jones: “In the past, there had always been a very proactive coalition of Member States intervening in support of the European Commission and in support of the United States, arguing that the framework should be valid, offering substantive legal argument as to why there are the necessary protections in place. For various reasons, I think it can’t be taken for granted that this will happen again.”
Kenneth Propp: “The Data Privacy Review Court (DPRC) itself, which stands as a quasi-judicial independent decision maker, that character of independence may become untenable, if the U.S. Supreme Court adopts a very robust version of the ‘unitary executive theory’, and essentially changes the jurisprudence in the U.S. that has governed the independence of executive agencies over the years. Any changes could be significant to how the Court of Justice of the EU will look at the data privacy framework.”
Kenneth Propp: “If the DPF were to fall (…) [there is a possibility] for the current U.S. administration to choose a course of confrontation, rather than conciliation with the European Union.”
Joe Jones: “If everything goes south, it might actually cause a bigger revisiting of the European Union’s approach to data transfers.”
Summary:
In this webinar, DeBrae Kennedy-Mayo and the panelists examine the EU General Court’s September ruling in the Latombe case and discuss what to expect from the Court of Justice of the European Union (CJEU) on Mr. Latombe’s appeal.
In the first part of the webinar, Joe Jones provides an analysis of the first-instance judgment, focusing on the EU General Court’s assessment of U.S. oversight of personal data processing by American intelligence and law enforcement authorities. Theodore Christakis subsequently addresses the admissibility of Latombe’s annulment request and explains how the EU General Court chose to bypass an analysis of standing, focusing instead on the merits of the case. He argues that the CJEU will likely find the appeal inadmissible because Mr. Latombe fails the strict standing requirements of EU law for direct annulment actions. He emphasizes that if the Court denies standing, it cannot legally pronounce on the validity of the framework, as doing so would amount to a ‘disguised advisory opinion’ outside its jurisdiction.
In the second part of the webinar, Joe Jones examines the impact of other European case law–such as the Bindl decision–on data transfers to the U.S., particularly regarding avenues for seeking compensation for unlawful transfers, including scenarios where the EU-U.S. DPF might be invalidated following the Latombe case.
Propp discusses in the third part of the webinar, national issues in the U.S., particularly changes in oversight agency commissioners, and how these potential changes in the U.S. could impact the CJEU’s decision in the Latombe case or, more generally, international and geopolitical relations on personal data transfers, as well as technology policy.
The experts conclude the webinar by outlining the possible outcomes of the Latombe case with the CJEU. They focus on what could reasonably occur if the EU-U.S. DPF is overturned on appeal, as well as the implications if the appeal is rejected and the framework’s validity is confirmed. In this context, they also address what might be expected should national courts, someday, raise preliminary questions in highly specific cases involving data transfers from the EU to the U.S and the validity of the EU-U.S. DPF.
* * *
These statements are attributable only to the authors, and their publication here does not necessarily reflect the view of the Cross-Border Data Forum or any participating individuals or organizations.
