For more than two decades, the issue of transatlantic data transfers has sat in a contested space at the intersection of privacy, national security, and digital commerce. The Court of Justice of the European Union’s decisions in Schrems I (2015) and Schrems II (2020) invalidated the European Commission’s adequacy decisions underpinning both EU-U.S. data transfer agreements (Safe Harbor and Privacy Shield). The finding that these agreements lacked adequacy was based on the principle that third country recipients of personal data from the European Union must provide a level of protection “essentially equivalent” to that provided under EU law, especially regarding surveillance safeguards and effective judicial redress. In response to these decisions, the European Commission adopted a third agreement in 2023: the EU-U.S. Data Privacy Framework (DPF). The Commission’s finding of adequacy was based on changes to U.S. signals intelligence oversight and the establishment of a new redress mechanism, the Data Protection Review Court (DPRC). This thesis examines whether the DPF’s surveillance and redress reforms address the structural issues that were outlined in the Schrems jurisprudence. It analyzes the first judicial review of the DPF in Latombe v. Commission (2025), where the General Court upheld the European Commission’s adequacy decision. While the decision confirms the legality of the DPF at the time of review, this thesis argues that the DPF remains structurally weak due to reliance on executive branch institutions and administrative oversight mechanisms, whose independence and durability remain contested within the U.S. constitutional system. The conditions that led to the CJEU’s decisions in Schrems I and Schrems II may not have been completely addressed by the DPF, thereby leaving open the possibility of a future “Schrems III”.