EU Law and Practice Contributed by: Charlotte Gerrish and Evane Alexandre, Gerrish Legal
International Data Transfers After the CJEU invalidated Safe Harbor and Pri- vacy Shield in Schrems (C-362/14) and Schrems II (C-311/18), the Commission adopted the EU–US Data Privacy Framework (Implementing Decision (EU) 2023/1795). In Latombe v Commission (T-553/23, 3 September 2025), the General Court upheld the ade - quacy decision, accepting that safeguards introduced by Executive Order 14086 and the Data Protection Review Court could ensure essentially equivalent pro - tection. The EDPB’s Guidelines 05/2021 (adopted 14 February 2023) clarified the cumulative criteria for a “transfer” under Chapter V, GDPR. Concurrently, CJEU case law has reaffirmed that supervisory authorities retain investigative powers even where an adequacy deci - sion exists, consistent with Schrems II . Practical takeaway Organisations should map cross-border data flows, rely on adequacy decisions where available, conduct and document transfer impact assessments for non- adequate destinations, and periodically reassess transfers – even where DPF certification applies. Security, Liability and Regulatory Convergence In Natsionalna agentsia za prihodite (C-340/21), the CJEU confirmed that fear of misuse after a breach may constitute compensable non-material damage under Article 82 GDPR, increasing litigation exposure. In IAB Europe (C-604/22), the court adopted a broad approach to joint controllership in digital advertis - ing, while in EDPS v SRB (C-413/23 P) it emphasised contextual identifiability in assessing pseudonymised data. Parallel obligations under the Digital Services Act (Regulation (EU) 2022/2065) and the Data Act (Regu - lation (EU) 2023/2854, applicable from 12 September 2025) reinforce convergence. Practical takeaway Organisations should implement integrated compli - ance models aligning GDPR governance with plat - form, advertising and data-sharing obligations.
Overall, enforcement reflects a fundamental-rights- oriented, proportionate and evidence-based standard: demonstrable, risk-based compliance embedded in organisational decision-making.
2. Privacy Litigation 2.1 Privacy Litigation Overview Mass and Collective Data Privacy Actions
A defining trend is the growth of mass claims, par - ticularly in jurisdictions with procedural mechanisms facilitating collective redress (eg, the Netherlands), and member states implementing the Representative Actions Directive (EU) 2020/1828). These mechanisms lower procedural barriers and increase strategic litiga - tion risk for large-scale data processing operations. Damages Courts across Europe are seeing a rise in compen - sation claims under Article 82, GDPR, especially for non-material damages – one of the most debated issues in EU data protection law. A central question is whether “loss of control” over personal data is suf - ficient to establish damage. The CJEU clarified in UI v Österreichische Post AG (C-300/21, 4 May 2023) that mere infringement of the GDPR is not sufficient: claim - ants must demonstrate actual damage and a causal link, although no minimum seriousness threshold is required. This leaves national courts discretion in interpreting and quantifying non-material harm. Security Beyond classic post-breach litigation, claims increas - ingly scrutinise the adequacy of technical and organi - sational measures under Article 32, GDPR, as well as incident detection and notification practices under Articles 33-34. In Natsionalna agentsia za prihodite (C-340/21), the CJEU confirmed that the mere occur - rence of a breach does not automatically establish non-compliance; courts must assess whether the security measures implemented were appropriate to the risk. International Data Transfers Cross-border data transfers remain a significant source of litigation and regulatory exposure. Organi - sations must navigate adequacy decisions, standard
95 CHAMBERS.COM
Powered by FlippingBook