The Court of Justice of the European Union will review a challenge to the EU-U.S. Data Privacy Framework, the adequacy decision that currently permits thousands of companies to transfer personal data from the European Union to the United States without additional safeguards.

The upcoming review, reported by WilmerHale in a client alert on the pending referral, puts the framework's legal survival back on the table barely two years after the European Commission adopted it. The court has not yet scheduled a judgment date, and no case outcome can be predicted from the referral alone.

What is at stake

The EU-U.S. Data Privacy Framework took effect on 10 July 2023, when the European Commission adopted its adequacy decision finding that the United States ensures a level of protection for personal data essentially equivalent to that guaranteed under the GDPR. The decision followed the signing of Executive Order 14086 by U.S. President Joe Biden in October 2022, which introduced binding safeguards on U.S. signals intelligence activities and established a redress mechanism for EU data subjects through the Data Protection Review Court.

Companies that self-certify under the framework rely on it as a standalone transfer tool. For those firms, the adequacy decision removes the need to negotiate standard contractual clauses, conduct transfer impact assessments, or build supplementary technical measures for data flows to the United States.

A familiar pattern of litigation

The referral reopens a line of litigation that has twice dismantled prior transatlantic transfer arrangements. The Court of Justice struck down the Safe Harbor accord in the Schrems judgment of 6 October 2015 (Case C-362/14) and invalidated its successor, the Privacy Shield, in Schrems II on 16 July 2020 (Case C-311/18). In both rulings, the court found that U.S. government surveillance programs and the absence of effective redress for European data subjects violated the fundamental rights protections enshrined in Articles 7, 8 and 47 of the EU Charter of Fundamental Rights.

The new challenge will test whether the Executive Order and the Data Protection Review Court cured the deficiencies the court identified in 2020.

Practical consequences for practitioners

For legal teams, the referral carries an immediate compliance message: the framework remains valid and enforceable until the court rules otherwise, but its long-term durability is once again uncertain. Organizations that depend exclusively on the framework for transatlantic data flows face a material regulatory risk while the case is pending.

Counsel should audit current transfer mechanisms and confirm whether fallback instruments — principally the European Commission's standard contractual clauses combined with documented transfer impact assessments — remain in place or can be reactivated quickly. Companies that abandoned SCC-based compliance after 2023 may want to assess whether reinstating those safeguards now is cheaper than a forced migration under a court-imposed deadline.

Data protection officers should also track the litigation timeline before the court, including any opinion of the Advocate General, which typically signals the direction of the ruling months before judgment. Given the two-year gap between referral and judgment in Schrems II, practitioners have some runway, but not indefinitely.

WilmerHale's alert signals that the referral is now before the Luxembourg court. The deciding body, the composition of the chamber, and the timeline for written and oral proceedings remain to be confirmed as the case docket advances.