On 31 July 2026, the European Data Protection Board (EDPB) formally asked the European Commission to assess whether a United States Supreme Court decision from late June threatens the legal foundation of the EU-US Data Privacy Framework (DPF); the mechanism that has allowed personal data to flow from the EU to certified U.S. companies without additional transfer safeguards since July 2023.
The request was prompted by the Court’s ruling on Trump v. Slaughter, which overturned a 1935 precedent shielding regulatory agencies in the US, including the Federal Trade Commission (FTC), from being removed by the president without cause. The FTC is the primary enforcement body for DPF commitments at the federal level, and the independence of its commissioners was a key factor in the EU Commission’s adequacy decision.
What the DPF actually is
The Data Privacy Framework is a self-certification system created in the U.S. to match EU data protection requirements. Under such a system, a U.S. company that wants to receive personal data from the EU applies, commits publicly to a set of principles that include purpose limitation, data security and individual rights, and gets listed on a public register.
Companies must specify the scope of data covered by their certification, renew annually and can be removed from the list for non-compliance. It is administered by the U.S. Department of Commerce.
The Federal Trade Commission enforces the commitments of the participating companies.
However, the programme would not matter under EU law without a second piece: the adequacy decision. The adequacy decision is a formal legal act by the European Commission. It was adopted in July 2023 and confirmed that the U.S. framework offers a level of data protection “essentially equivalent” to EU standards.
The DPF is the third attempt at this kind of arrangement. The two earlier mechanisms for transatlantic data transfers, “Safe Harbour” and “Privacy Shield”, were both struck down by the EU’s Court of Justice (CJEU), in decisions commonly known as Schrems I (2015) and Schrems II (2020). Both cases rested largely on the same issue: EU citizens had no adequate way to challenge U.S. intelligence agencies’ access to their data.
To fix that, in October 2022, the Biden administration issued an Executive Order creating a redress mechanism for EU citizens against U.S. signals intelligence activities. Two bodies were created: the Civil Liberties Protection Officer (CLPO) for initial investigations, and the Data Protection Review Court (DPRC) for appeals of CLPO decisions.
The DPRC’s creation, along with the FTC’s independent enforcement role, was central to the European Commission’s reasoning for granting adequacy in July 2023. Commerce opened the self-certification programme that same month.
The two different roles of the DPRC and FTC
Much of the current debate rests on distinguishing between two oversight bodies: the DPRC and the FTC. They were both key elements in the adequacy decision, but they have different roles.
The FTC’s role is commercial. Once a company self-certifies to the DPF Principles, the FTC is the primary regulator that can bring enforcement action if that company misrepresents its compliance or fails to honour its stated privacy commitments.
The DPRC’s role is entirely different: it handles complaints that U.S. government intelligence agencies improperly accessed someone’s personal data through signals intelligence activities. This is the redress mechanism built specifically to answer the concerns raised in Schrems II.
Both the Schrems I and II cases focused on U.S. surveillance law and the effectiveness of redress for EU individuals, not on the commercial side. Slaughter, by contrast, concerns the FTC. And the FTC does not have jurisdiction over national security.
The distinction matters for how much damage Slaughter can actually do.
The Slaughter ruling and why it matters for adequacy
The European Commission’s 2023 adequacy decision relied in part, but explicitly, on the independence of the FTC as evidence that DPF commitments would be enforced. The decision noted that FTC commissioners could be removed only for “inefficiency, neglect of duty, or malfeasance in office”. Slaughter removes that protection. And that is why, on 31 July, the EDPB asked the Commission to “closely assess” the consequences of the judgment.
For now, the Commission has indicated only that it will continue to “carefully analyse” any implications of the ruling, while the adequacy decision remains in force. But this caution is not new. According to the International Association of Privacy Professionals (IAPP), back in April, before the ruling, Commissioner McGrath described the DPF as “mutually beneficial to both sides”, adding that “there is recognition in the US, and certainly there is on the European Union side that there is too much at stake to allow [the DPF] to slip.”
Does Slaughter undermine the whole framework?
Legal opinion is split on the extent of Slaughter’s reach.
Not everyone necessarily agrees that the Supreme Court decision is a real threat to the DPF. Some legal scholars argue that even though the FTC has lost some independence, the DPRC is different. The DPRC was created by executive order and Department of Justice (DOJ) regulations, not by Congress. These regulations allow removal of DPRC judges only for cause. Moreover, the Supreme Court explicitly left open whether its reasoning applies to this kind of body at all. “Nothing has changed for the redress mechanism”, according to them.
Even in a worst-case scenario, where the whole framework is challenged over the FTC issue, companies could still legally transfer data through other tools like standard contracts, since those don’t depend on the FTC at all.
However, the DPF faces a more direct challenge than the EDPB request for review.
Max Schrems, the privacy activist behind the original Safe Harbour and Privacy Shield rulings, has announced that his organisation, noyb, is preparing a new legal challenge before the CJEU. In a letter sent to the Commission the day after the ruling, noyb has also asked the European Commission to withdraw the adequacy decision. It argues that the logic in Slaughter goes beyond the FTC, reaching the DPRC as well: since a president can overturn an executive order at will, any independence built on one is “logically irrelevant”. That constitutes a genuine constitutional deadlock, according to noyb, and the European Commission has no choice but to begin winding down the framework.
What happens now and what should companies be doing
For businesses, nothing changes immediately. The adequacy decision remains valid for now, so transfers under the DPF remain lawful.
However, companies relying on DPF certifications for data transfers from the EU to the U.S. should ensure that alternative transfer mechanisms, particularly Standard Contractual Clauses (SCCs) or Binding Corporate Rules (BCRs), are available if the framework is eventually invalidated.
Even though noyb argues these fallbacks may also not be as solid as they appear, the use of these GDPR-recognised transfer mechanisms is likely to become more common practice while the FTC question remainsunresolved.
According to experts, companies should also regularly update Transfer Impact Assessments (TIAs), prioritising reliance on the DPF while maintaining SCCs and supplementary measures as a contingency plan.
If your organisation relies on the EU-US Data Privacy Framework, now is the time to review your data transfer strategy. Get in touch with HewardMills to assess your exposure, explore fallback options such as SCCs and BCRs, and ensure your TIAs are up to date.
