Microsoft 365, Salesforce, AWS, Google Cloud, or numerous AI tools—for many companies, data transfers to the U.S. are simply indispensable. Consequently, the U.S. Supreme Court’s decision on June 29, 2026, has drawn significant attention: In the case of Trump v. Slaughter, the highest U.S. court has undermined the independence of the Federal Trade Commission (FTC), a consumer protection agency, and thus one of the cornerstones of the EU-U.S. Data Privacy Framework (DPF). Consequently, it is necessary to examine whether and to what extent this could render data transfers to the U.S. unlawful, and what remedial measures companies must take immediately.
Transfers to Third Countries, Adequacy Decisions, and Article 46 of the GDPR
Under Article 44 et seq. of the GDPR, personal data may only be transferred to a non-EU country if that country provides a level of protection that is essentially equivalent. This can be achieved through an adequacy decision by the European Commission (Article 45 of the GDPR) or through appropriate safeguards under Article 46 of the GDPR, such as Standard Contractual Clauses (SCCs) or Binding Corporate Rules (BCRs). Companies must also inform data subjects about the transfer to a third country (Articles 13 and 14 of the GDPR).
U.S. vs. China & Co.: The Role of the Data Privacy Framework
An adequacy decision based on the DPF has been in effect for the U.S. since 2023. U.S. companies can register on a list maintained by the U.S. Department of Commerce if they acknowledge comprehensive data protection obligations. EU companies may then transfer data to these recipients. For other countries without an adequacy decision—such as China—only the mechanisms under Article 46 remain, namely tailored contractual arrangements combined with risk assessments and technical safeguards.
Trump v. Slaughter: Supreme Court Overturns the FTC’s Independence
On June 29, 2026, the U.S. Supreme Court ruled in Trump v. Slaughter (No. 25 332) that the President may remove commissioners of the Federal Trade Commission (FTC) at any time without cause. The FTC is a U.S.federal agency for competition and consumer protection that acts as the central supervisory authority in the context of data protection by monitoring and sanctioning companies’ compliance with data protection obligations and plays a key role as an independent supervisory authority under the EU-U.S. Data Privacy Framework. It is now losing the institutional independence it has enjoyed for nearly 100 years, as the President can influence the agency’s partisan composition and stability through unrestricted removal. In contrast, European data protection authorities, under Art. 51(1) of the GDPR to be independent.
A Threat to the Data Privacy Framework—But Not an Immediate End
The EU Commission’s adequacy decision explicitly cites, in numerous places, the fact that the FTC is structured as an independent agency. Accordingly, several voices in legal media coverage criticize the fact that the FTC is now structured as an agency subject to the President’s directives and express concerns that the Data Privacy Framework may be unlawful, and consequently that data processing measures based on it may also be unlawful.
In fact, however, the adequacy decision remains formally in effect until it is revoked by the European Commission or declared invalid by the European Court of Justice. Ongoing transfers based on the DPF are therefore not automatically prohibited. However, developments in this area must be closely monitored, especially since two previous regulations governing the DPF have already been declared invalid by the CJEU.
Business Planning
Companies should neither exaggerate nor ignore the situation. As soon as developments that could undermine the DPF are on the horizon, data transfers to the U.S. that rely solely on the DPF should be reviewed. Alternatives would include standard contractual clauses in individual contracts or BCRs to establish the required equivalent level of protection and thus justify a data transfer. This would generally make the process more complex, although there is currently no immediate threat.
Conclusion
The DPF has been legally undermined, but it has not yet been overturned. Concerns about the political structure of U.S. institutions do not, in and of themselves, render such an agreement null and void. Those who closely monitor developments and diversify their investment instruments in light of expected trends can reduce liability risks—and buy time in case action is needed in the future after all.
