Action brought on 6 September 2023 – Latombe v Commission

(Case T-553/23)

Language of the case: French

Parties

Applicant: Philippe Latombe (Nantes, France) (represented by: N. Coutrelis and J.-B. Soufron, lawyers)

Defendant: European Commission

Forms of order sought

The applicant claims that the Court should:

annul Articles 1 and 2 of Commission Implementing Decision C(2023) 4745 final, of 10 July 2023, pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate level of protection of personal data under the EU-US Data Privacy Framework;

order the European Commission to pay the costs.

Pleas in law and main arguments

The applicant puts forward five pleas in law in support of the action.

First plea in law, alleging infringement of Regulation No 1/1958. ¹ The applicant claims that the contested decision was notified to the Member States in breach of Article 4 of that regulation, which provides that regulations and other documents of general application are to be drafted in the official languages of the Union.

Second plea in law, alleging infringement of Articles 7 and 8 of the Charter of Fundamental Rights of the European Union (‘the Charter’) due to the inadequacy of guarantees of respect for private and family life in view of the widespread and ‘bulk’ collection of personal data.

Third plea in law, alleging infringement of Article 47 of the Charter and of Article 45(2) of Regulation 2016/679 ¹ due to the absence of a guarantee of the right to an effective remedy and access to an independent tribunal. The applicant submits that the appeal body set up in the United States, established by an act of the United States executive and not by law, is not an independent tribunal and does not offer guarantees similar to those required by EU law.

Fourth plea in law, alleging infringement of Article 22 of the General Data Protection Regulation due to the absence of a framework for automated decision-making. The applicant refers to the fact that United States law does not provide for any general safeguard against automated decision-making, the risk of occurrence of which is accordingly not eliminated by the arrangement put in place.

Fifth plea in law, alleging infringement of Article 32, read in conjunction with Article 45(2), of the General Data Protection Regulation due to the absence of safeguards relating to the security of processed data, on the ground that United States law provides merely for vague measures and not precise obligations incumbent upon the operators transferring the data.

____________

¹ Council Regulation No 1 of 15 April 1958 determining the languages to be used by the European Economic Community (OJ English Special Edition 1952-1958, p. 59).

¹ Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1, and corrigendum OJ 2018 L 127, p. 2).