In a recent legal development, on the 12th of October 2023, the Court of Justice of the European Union (CJEU) made a significant decision by dismissing an application of interim relief filed by Philippe Latombe, a member of the French Parliament, concerning the EU-US Data Privacy Framework (DPF). The CJEU determined that Latombe failed to establish the presence of serious and irreparable harm, which is a prerequisite for the urgency of interim measures.
Latombe's application did not adequately explain why the DPF's data transfers to the US would cause him specific serious harm. While he described the general negative aspects of the DPF, he didn't clarify the nature of the personal damage he would personally experience. Furthermore, he claimed to use certain IT tools like Microsoft 365, Google and Doctolib, but failed to provide evidence that these tools would result in data transfers to the organisations or specify the type of personal data involved. The European Commission contended that alternative data mechanisms were already available.
The CJEU emphasised that the party seeking interim measures must demonstrate the imminent risk of severe, irreparable harm. A mere prima facie case, even if particularly serious, cannot compensate for the absence of such a demonstration, except in very limited circumstances. Consequently, the CJEU rejected Latombe's request for interim relief without delving into the request's admissibility, examining the merits of the case, or conducting a balancing of interests.
This legal saga began with the European Commission's adequacy decision regarding the EU-US DPF on the 6th of September, 2023 (see our previous blogpost Unlocking Data Flows: EU-US Data Privacy Framework Receives Adequacy Decision for further details). In a press release on the 8th of September, Latombe, acting in his personal capacity as a European Union citizen, raised concerns. He highlighted the lack of debate on the DPF in the European Parliament and member state parliaments, the absence of the DPF text in languages other than English, inadequate guarantees for effective remedies in personal data protection, and concerns over mass surveillance in the US.
Lacombe views his legal action as faster avenue for addressing these issues compared to the challenge planned by noyb and Max Schrems. The case is officially titled 'Latombe v Commission' (Case T-553/23), although specific documents related to the case have not yet been made public.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.