An European Union court upheld the pact governing the transfer of personal data between the 27-nation bloc and the United States on Wednesday, Spetember 3, dismissing a challenge by a French lawmaker. In effect since 2023, the EU-US Data Privacy Framework was the bloc's third attempt at a legal framework to protect Europeans' personal data in exchanges with the US. The previous two accords – called Safe Harbor and Privacy Shield – were struck down by the EU's top court following challenges led by Max Schrems, an Austrian legal activist.

"On the date of adoption of the contested decision, the United States of America ensured an adequate level of protection for personal data transferred from the European Union to organisations in that country," the EU's General Court found in its ruling.

The centrist French lawmaker Philippe Latombe brought his challenge to the existing pact before the Luxembourg-based General Court – the lower chamber of the Court of Justice of the European Union – in 2023. He sought its annulment on the grounds it did not fully respect the bloc's own data protection rules, and argued the practice of US intelligence agencies collecting personal data in bulk while in transit from the EU was illegal.

Finding against him on all counts, the General Court said it "dismisses the action in its entirety."

Business groups had raised the alarm over the prospect of a protracted new legal fight, should Latombe prevail in court. The US-based digital lobby group the Business Software Alliance (BSA) welcomed the ruling. "This outcome provides stability and reassurance for businesses and consumers on both sides of the Atlantic who rely every day on trusted cross-border data flows," the group said in a statement.