The legal basis for transatlantic transfers of personal data is once again attracting scrutiny. On 29 June 2026, the U.S. Supreme Court held in Trump v. Slaughter that the statutory protection preventing the President from removing Federal Trade Commission (FTC) commissioners except for cause is unconstitutional. The Court concluded that the FTC exercises executive power and must therefore remain subject to presidential control.

The judgment does not concern data protection or international data transfers as such. Its significance for the EU-U.S. Data Privacy Framework (DPF) arises from the role attributed to the FTC in the European Commission’s 2023 adequacy decision. In that decision, the Commission expressly described the FTC as an independent authority and referred to the statutory protection of its commissioners against removal except for inefficiency, neglect of duty or malfeasance in office. The FTC is also one of the principal U.S. authorities responsible for enforcing compliance by organisations participating in the DPF.

The development has now also prompted an institutional response at EU level. In a letter dated 31 July 2026, the European Data Protection Board (EDPB) noted that the existence and effective functioning of independent supervisory authorities is a key factor under Article 45(2)(b) GDPR when assessing the adequacy of a third country’s data-protection regime. The EDPB therefore asked the European Commission to closely assess whether the Supreme Court judgment affects the functioning of the DPF adequacy decision.

Privacy organisation noyb, founded by Max Schrems, has taken a more critical position. It argues that the Supreme Court ruling undermines an important premise of the current transatlantic transfer regime and has called on the EU Commission to provide for an orderly withdrawal of the adequacy decision. noyb has also announced its intention to challenge the DPF before the Court of Justice of the European Union. As of August 2026, however, the announced action does not appear to have been filed.

For the time being, the immediate legal position remains unchanged. Commission Implementing Decision (EU) 2023/1795 continues to be in force, and transfers to U.S. organisations covered by the DPF may therefore continue to rely on the adequacy decision under Article 45 GDPR. The Supreme Court ruling does not itself invalidate the DPF. Any change to that position would require, in particular, action by the European Commission or a decision by the EU courts.

The judgment nevertheless introduces a further element of legal uncertainty into a transfer regime that followed the invalidation of both Safe Harbour in Schrems I and the EU-U.S. Privacy Shield in Schrems II. Whether Trump v. Slaughter will ultimately have comparable consequences for the DPF remains open. The EDPB has, for now, limited itself to requesting a closer assessment of the impact of the ruling rather than calling for suspension or withdrawal of the framework.