Unintended Consequences: EU-US Data Transfers Under Threat?

The EU-US Data Privacy Framework (the “DPF”) is a primary legal mechanism for transferring personal data from the EU to the US since the European Commission's adequacy decision in July 2023. It is the third transfer arrangement after Safe Harbor was invalidated by the CJEU in Schrems I (2015) and Privacy Shield in Schrems II (2020). Both frameworks failed because the CJEU found US surveillance laws and lack of redress meant EU data subjects lacked equivalent protection. The DPF aimed to fix these issues, but a recent US Supreme Court decision now threatens its future.

In Trump v Slaughter, the US Supreme Court ruled President Trump could dismiss FTC commissioner Rebecca Slaughter without cause, affirming the President's constitutional authority over independent agencies. This decision potentially challenged the FTC’s independence and the validity of the DPF.

The adequacy decision underpinning the DPF is, in material part, based on the independence and effectiveness of US oversight and enforcement mechanisms, which ensure that EU data subjects are afforded an essentially equivalent level of protection for their personal data. The FTC occupies a central role in this framework: it is responsible for enforcing DPF commitments made by US companies and for providing an avenue of redress for EU individuals who believe their right to the protection of their personal data has been violated.

The US Supreme Court ruling calls into question the EU Commission’s DPF adequacy decision. If FTC commissioners can be removed at the US President’s order, it is arguable that such agencies are no longer independent supervisory authorities as required under EU law. The CJEU’s judgments make clear that the effective independence of oversight bodies is a prerequisite for any finding of adequacy.

While the ruling does not immediately invalidate the DPF, at least one privacy advocacy group has already indicated its intention to challenge the adequacy decision regarding the DPF in light of this ruling. The EU Commission may also review the adequacy decision on its own initiative if it is of the opinion that EU data subjects are no longer afforded an equivalent level of personal data protection in the US.