Schrems III Risk: Planning for a DPF Legal Challenge

Philippe Latombe, a French parliamentarian, sought annulment of the adequacy decision, arguing the DPRC is not an independent tribunal and US bulk collection lacks prior authorization. In September 2025 the EU General Court dismissed the action on the merits, holding the Commission could reasonably find the DPRC sufficiently independent (judges protected from removal, procedural guarantees, executive-branch location not disqualifying under the essential-equivalence standard) and that US signals-intelligence safeguards under EO 14086, including ex post DPRC review of bulk collection, met the required level. What it leaves open: an appeal to the CJEU on points of law; a future preliminary reference under Article 267, the route both Schrems judgments took, arriving with a fuller evidentiary record from national litigation; and challenges built on post-2023 facts rather than the decision's adoption-time record, notably whether the EO 14086 machinery still operates as the Commission assumed. Latombe raised the bar for facial challenges; it does not immunize the decision against a record showing changed US practice.

Three paths, different speeds. CJEU invalidation: a preliminary reference from a national court (the Schrems pattern, complaint to DPA, litigation, reference) typically takes three to five years from complaint to judgment; an appeal of Latombe would be faster but is limited to points of law. Invalidation takes effect immediately upon judgment, no grace period, as in 2015 and 2020. Commission suspension or repeal: the decision requires periodic review, and the Commission can suspend, amend, or repeal if US safeguards degrade; the European Parliament has pushed for exactly this at various points, and material changes to EO 14086, the DPRC, or oversight bodies would force the question; timeline is political, months from a triggering event, and could include a transition period, unlike a court judgment. US-side withdrawal: a US administration could revoke or gut EO 14086; the decision's factual basis evaporates and the Commission must act. Monitoring signals worth automating: CJEU docket activity, Commission review reports, EO 14086 amendments, DPRC appointments and caseload, and PCLOB composition, several of these moved in 2025 and drew formal EU questions.

The adequacy basis for DPF-reliant flows disappears at the moment of invalidation. Transfers must stop or switch to an Article 46 mechanism immediately: in 2020 the CJEU gave no grace period, the EDPB confirmed none existed, and noyb filed 101 complaints against companies still running Privacy Shield-era transfers within weeks. Certified importers keep their DPF obligations for data already received (the Principles are sticky and the FTC has said framework commitments remain enforceable regardless of EU-side validity, as it did after Schrems II), but that protects the data, not the flow. SCCs signed as fallback activate, subject to the harder problem Schrems II created: the same judicial reasoning that killed the adequacy decision will color TIAs for US transfers, so expect DPA guidance within weeks on what supplementary measures suffice, and expect encryption-with-exporter-keys and pseudonymization to carry the analysis. Flows that cannot support those measures (US vendor needs cleartext access to EU data) are the genuinely exposed category; identify them now, because they are the ones that may need re-architecture rather than re-papering.

Five artifacts, built in calm weather. Mechanism inventory: per-flow records (data category, entities, current mechanism, fallback mechanism, cleartext-dependency flag), without which nothing else executes. Springing SCCs: pre-executed clauses with key US counterparties drafted to govern if the DPF ceases to provide a valid basis, or at minimum template packs with module selection pre-made; after 2020, this became standard practice in negotiated DPAs. TIA scaffolding: destination-law analysis pre-drafted for your main US importers so post-judgment TIAs are updates, not originals; EO 14086 analysis remains relevant to SCC transfers even if adequacy falls. Trigger playbook: named convener, 48-hour assessment meeting, decision matrix (which flows switch, which pause, which escalate), counterparty notice templates, and privacy-policy edit list (participation claims may need adjusting even though certification itself survives EU-side invalidation). Exposure triage: the pre-identified cleartext-dependent flows with re-architecture options sketched (EU processing, key custody changes, vendor substitution). Companies with these five re-papered in weeks after Schrems II; the median company took most of a year.

Not automatically, but the dependencies are real. Legally: the UK's adequacy regulations and Switzerland's recognition are independent instruments under their own laws; a CJEU judgment binds neither. Structurally: both rest on the same EO 14086 safeguards and the same Commerce Department program, and the UK Extension requires an active EU-US certification, so if a US organization's certification lapses in a post-invalidation unwind, UK coverage lapses with it (the UK Extension cannot stand alone). Politically: a CJEU finding that US safeguards fail essential equivalence would pressure the UK government's own monitoring commitments and hand ammunition to challenges under UK law; Switzerland's FDPIC would face the same question. Planning consequence: run the UK and Swiss flows through the same mechanism inventory with their own fallback column (IDTA or UK Addendum with a UK transfer risk assessment; Swiss-law SCC adaptations), and treat 'EU decision falls, UK bridge survives six more months' as a plausible middle scenario in which flow-by-flow routing, not framework-level assumptions, keeps you compliant.