EU Data Protection Board urges review of EU‑US Data Privacy Framework after US Supreme Court ruling

The U.S. Supreme Court’s decision in Trump v. Slaughter (June 29) held that statutory protections shielding Federal Trade Commission (FTC) commissioners from removal by the President are unconstitutional, allowing the President to dismiss commissioners at will.

The ruling calls into question the independence of the FTC, a factor that underpinned the European Commission’s 2023 adequacy decision for the EU‑US Data Privacy Framework (DPF), which enables the transfer of personal data between the EU and participating U.S. organisations.

On 31 July, the European Data Protection Board (EDPB), chaired by Anu Talus, wrote to the European Commission asking it to assess whether the Supreme Court decision undermines the DPF’s validity. The framework remains fully in force and transfers continue, but the Commission may open a procedure to suspend, amend or repeal the adequacy finding if it concludes the conditions are no longer met.

Privacy advocacy group noyb has also urged the Commission to act, and the Latombe challenge to the DPF is pending before the Court of Justice of the EU. Companies that rely on the framework are awaiting the Commission’s assessment for clarity on the future stability of transatlantic data transfers.