What the US Supreme Court's ruling in Trump v. Slaughter means for companies moving personal data across the Atlantic — and why this pattern should feel familiar by now
Most companies run one data setup for everyone — one consent flow, one transfer mechanism, one policy covering US and EU users alike. On June 29, 2026, the legal basis under a significant part of that setup changed.
The US Supreme Court ruled 6-3 in Trump v. Slaughter that the Federal Trade Commission is not constitutionally independent. The case came down to a straightforward question: can the president fire FTC commissioners without cause? The conservative majority said yes. The ruling overturned Humphrey's Executor, a 91-year-old precedent that had protected members of independent agencies from arbitrary presidential removal.
The decision has nothing to do with data privacy on its face. It's a constitutional case about separation of powers. But the downstream effect on EU-US data transfers is significant — because the EU-US Data Privacy Framework, the mechanism that currently allows personal data to flow legally from the EU to the US, references the FTC's independence 259 times.
Why the DPF Depended on FTC Independence
The EU's approach to international data transfers starts from a strict baseline: personal data can only leave the EU if the destination country provides protections that are essentially equivalent to those under GDPR. One of the key requirements is independent oversight — an authority that enforces data protection rules without political interference.
Since 2000, the European Commission has used the FTC as the designated US enforcement body in its adequacy assessments — the decisions that allow free data flows between the EU and the US. Safe Harbour relied on it. Privacy Shield relied on it. The current Data Privacy Framework, adopted in 2023, relied on it 259 times.
EU treaty law — specifically Article 16(2) TFEU and Article 8(3) of the Charter of Fundamental Rights — requires that oversight over data protection matters be conducted by an independent authority. The Court of Justice of the EU made clear in both Schrems I (2015) and Schrems II (2020) that this requirement applies to third countries seeking adequacy decisions too.
The FTC is no longer independent. The Supreme Court said so explicitly. FTC commissioners are now effectively at-will employees who serve at the pleasure of the president, and the bipartisan structure Congress built into the agency no longer has constitutional protection. The agency that the European Commission relied on as the cornerstone of EU-US data transfer oversight just lost the property it was being relied on for.
The Pattern Here Is Not New
This is the third time the EU-US data transfer relationship has reached this point. Safe Harbour was invalidated by the CJEU in 2015. Privacy Shield fell in 2020. Both collapsed for the same underlying reason: US surveillance law and the absence of genuinely independent oversight meant EU data subjects weren't afforded the equivalent protections EU law requires.
The Data Privacy Framework was designed to address those weaknesses. It relied on Executive Order 14086 and a new body called the Data Protection Review Court — a redress mechanism for EU individuals whose data may have been accessed by US intelligence. The DPRC is housed within the US Justice Department and exists only by executive order — meaning it can be changed by the president at any time and is not binding on future administrations. The PCLOB, another oversight body the framework depended on, was already compromised earlier this year.
The organisation has already responded: noyb has sent a formal letter to the European Commission requesting it begin an orderly withdrawal of the adequacy decision, and has announced its intention to file litigation before the CJEU to have the DPF annulled. Based on the timelines of the previous two challenges, that litigation could take two to three years to reach a final decision.
What This Means Right Now
The most important practical point: the adequacy decision is still formally in force. The European Commission has not withdrawn it. The European Data Protection Board has issued no guidance instructing companies to stop relying on it. US companies certified under the DPF remain on the list and can still receive covered transfers today.
For companies relying directly on the DPF adequacy decision, there is no immediate operational change required. The Commission's determination provides formal cover for as long as the decision remains in force — regardless of the legal arguments now stacking up against it.
For companies using Standard Contractual Clauses or Binding Corporate Rules instead, the situation is more immediate. SCCs and BCRs require companies to maintain their own Transfer Impact Assessment — an affirmative conclusion that the US provides essentially equivalent protection. Those assessments have typically relied on the FTC, PCLOB, and the DPRC as evidence of adequate oversight. All three are now legally weakened. A TIA updated honestly today is significantly harder to sign off on than it was last week. Companies relying on SCCs face an obligation to update that assessment — and the outcome of updating is predictable.
This creates a paradox that privacy practitioners have already noted publicly: the DPF, widely expected to be the least stable mechanism, now offers more short-term formal cover than SCCs — because DPF reliance doesn't require a company to personally certify that the legal framework is sound.
What to Watch
A few developments that will determine how this plays out:
The CJEU challenge. noyb will file litigation seeking to have the adequacy decision annulled. This is the same route that killed Safe Harbour and Privacy Shield. A final ruling typically takes two to three years — but legal uncertainty starts now, not when the ruling comes down.
The European Commission's response. The Commission has shown, consistently, that it moves slowly under political and commercial pressure. Safe Harbour and Privacy Shield both survived longer than the legal arguments against them warranted. The Commission may do the same with the DPF. It may also conduct a review under its existing monitoring obligations, given that a significant change in US oversight structure has now occurred.
The Data Protection Review Court. The DPRC's legal status was already being challenged before Trump v. Slaughter. Its continued operation under the current executive order — and whether the Trump administration chooses to maintain it — is a separate thread worth tracking.
What happens to your TIA. For any company using SCCs for US transfers, the question isn't whether to update the Transfer Impact Assessment — it's when and how to document the updated analysis. Leaving a pre-June 2026 TIA in place without review is a documented compliance gap.
The Bigger Pattern
What strikes me about this situation, looking at it from the work I do with companies on cross-border compliance, is how often the underlying problem is the same: a legal mechanism that felt settled gets built into a company's data infrastructure as a permanent assumption, and then the mechanism changes.
Companies that have invested in understanding what personal data they process, where it goes, what legal basis applies to each flow, and what happens if that basis disappears — they're in a different position from companies that have been running on the assumption that the DPF or SCCs are permanent fixtures. They're not. They never have been.
This is the clearest possible illustration of why handling EU and US traffic as a single, uniform data category isn't just a technical oversight. It's a compliance risk that can materialize quickly and with significant operational impact.
Olena Rozenvasser will be covering this in detail in her September session on EU and US data compliance. Registration details coming soon.