US Supreme Court Ruling Undermines EU-US Data Privacy Framework

On 24 June 2026 the U.S. Supreme Court, in *Trump v. Slaughter*, ruled that the Federal Trade Commission lacks constitutional independence. The decision undermines the FTC’s role as the independent overseer required by the EU-US Data Privacy Framework for data transfers.

EU-US Data Privacy Framework shaken to its vore

The EU has limited personal data exports since 1995, allowing only narrow exceptions. The Commission deemed the United States adequate in 2000, a status revoked by the CJEU in Schrems I (2015) and Schrems II (2020). The EU-US Data Privacy Framework, modeled on its predecessors, entered into force on 10 July 2023. Commission has relied on the FTC’s oversight 259 times in adequacy decisions. 2026 Supreme Court ruling revives the uncertainty that prompted the earlier invalidations.

EU-US Data Privacy Framework shaken to its vore

If the FTC cannot meet EU independence standards, Standard Contractual Clauses and Binding Corporate Rules that rely on the DPF may lose legal effect. Companies may need to adopt data-localisation, revise risk assessments, and prepare for cloud-service disruptions.

US Supreme Court FTC Ruling Raises Fresh Threat to EU–US Data Transfers

The European Commission said the ruling will be examined by experts before any policy shift. The Dutch Data Protection Authority confirmed the United States remains one of fifteen adequate jurisdictions. NOYB has formally asked the Commission to repeal the DPF, calling it a “legal house of cards” built under industry pressure. Max Schrems argues the framework is dead and urges an orderly exit from U.S. cloud providers.

US Supreme Court just blew up EU-US Data Transfers

Analysts note adequacy decision stays in force until the CJEU annuls it, so transfers are not instantly halted. Others warn ruling creates long-term risk that could trigger a third invalidation (“Schrems III”).

US Supreme Court FTC Ruling Raises Fresh Threat to EU–US Data Transfers

• “Crucially, the EU constitutional framework requires independent oversight. The only way to change this would be a unanimous vote by all EU Member States to change the EU treaties.” — Max Schrems, privacy activist

US Supreme Court just blew up EU-US Data Transfers

• “In a letter sent to the European Commission on Tuesday (30 June), Schrems says the US judges have undermined the independence of the Federal Trade Commission (FTC).” — Max Schrems, press statement

EU Observer

• “The ruling is unlikely to have an immediate effect on EU–US data transfers, but its long-term consequences could be significant, potentially marking a point of no return. It hands privacy advocates like NOYB and Max Schrems a strong new argument that US data transfers are now illegal.” — Dr Ilia Kolochenko, cybersecurity lawyer

US Supreme Court FTC Ruling Raises Fresh Threat to EU–US Data Transfers

• “The question is not only legal, but also political. If the EU acts imprudently, its own businesses may suffer from a deterioration of EU–US economic collaboration.” — Dr Ilia Kolochenko

US Supreme Court FTC Ruling Raises Fresh Threat to EU–US Data Transfers

The Commission may repeal the DPF or negotiate a revised framework, while NOYB plans a CJEU challenge that could lead to a third invalidation. Stakeholders should monitor developments and consider data-localisation.

US Supreme Court FTC Ruling Raises Fresh Threat to EU–US Data Transfers