EU-US Data Privacy Framework Under the Spotlight Following FTC Independence Ruling

Aug 06 2026

The European Data Protection Board (EDPB) has called on the European Commission to assess the implications of the recent US Supreme Court decision in Trump v. Slaughter for the EU-US Data Privacy Framework (DPF), the mechanism that facilitates transfers of personal data between the EU and participating US organisations.

The EDPB’s request follows the Supreme Court’s decision, handed down at the end of June, which held that the US President may dismiss Federal Trade Commission (FTC) commissioners without cause. The ruling has raised questions about the independence of the FTC.

These concerns stem from the fact that the European Commission’s 2023 adequacy decision, which found that the United States ensures an adequate level of protection for personal data, relies in part on the FTC operating as an independent supervisory authority. The adequacy decision specifically notes that FTC commissioners may be removed by the President only for inefficiency, neglect of duty, or malfeasance.

According to the EDPB, a key factor in assessing whether a third country provides an adequate level of data protection is the existence and effective functioning of one or more independent authorities responsible for supervising compliance with data protection requirements. In light of the uncertainty surrounding the FTC’s independence, the potential impact of the Supreme Court’s decision on the EU-US DPF remains unclear.

For now, organisations may continue to rely on the EU-US DPF as a valid mechanism for transferring personal data from the EU to the United States. Alternative transfer mechanisms, including Standard Contractual Clauses (SCCs) and Binding Corporate Rules (BCRs), also remain available and lawful.

The European Commission’s assessment will be closely watched by businesses that rely on the framework for transatlantic data transfers. The Commission’s conclusions may provide important clarity on the future stability of the DPF and the wider EU-US data transfer landscape.