Overview
Complying with European privacy rules governing the transfer of personal information to the U.S. has always been challenging for U.S. companies.
Now, a seemingly unrelated U.S. Supreme Court decision, Trump v. Slaughter, may create new uncertainty around the legal framework governing those transfers, raising fresh considerations for companies that do business in Europe.
A History of EU-U.S. Personal Data Transfer Challenges
For more than two decades, the U.S. and EU have struggled to establish a system that allows U.S. businesses to move personal information back and forth between the two territories in a way that complies with European privacy laws. A succession of “frameworks,” followed by successful challenges to those frameworks in European courts, has made it difficult, at times, for U.S. companies to understand what the rules are and what they need to do to comply with them.
The 2023 EU-U.S. Data Privacy Framework and GDPR Adequacy
After painstaking negotiations in the wake of the EU Court of Justice’s 2020 Schrems II decision, the U.S. and EU brought some much-needed predictability to this area in 2023 when they signed the EU-U.S. Data Privacy Framework (DPF). In exchange for commitments by the U.S. government to protect the data rights of Europeans, the European Commission determined that the U.S. was an “adequate” country under Article 45 of the European privacy law, the General Data Protection Regulation (GDPR). While the DPF wasn’t a perfect solution, it established the basic principle that U.S. companies could implement data safeguards that met the GDPR’s standards.
One of the fundamental principles of the GDPR is that personal data rights must be enforced by “independent supervisory authorities”— agencies that operate independently of political leadership. Because of this, a factor in the 2023 U.S. adequacy determination was the independence of the Federal Trade Commission (FTC). Citing the FTC’s five-person bipartisan commission structure and its statutory insulation, negotiators could characterize it as an independent privacy regulator for the purposes of Article 45 adequacy.
Why Trump v. Slaughter Could Threaten EU-U.S. Data Transfers
In Trump v. Slaughter, the U.S. Supreme Court overruled precedent and decided that the president has the power to fire a commissioner of the FTC without identifying a reason. With this finding, it is questionable whether the agency would still be recognized as sufficiently independent, and because the FTC's independence was a key factor in the European Commission's 2023 adequacy determination, Slaughter has raised new questions about whether the U.S. still meets the GDPR’s adequacy standard.
Interestingly, Austrian privacy activist, Max Schrems, the lead litigant in the aforementioned Schrems II decision, reacted to this turn of events in a blog he titled: “US Supreme Court just blew up EU-US Data Transfers.” Then, on August 3, 2026, the European Data Protection Board (EDPB), the organization of European privacy regulators, wrote a letter to the European Commission asking the Commission to “closely assess” how Slaughter impacts the 2023 U.S. adequacy determination.
What U.S. Businesses Should Expect Next
If Slaughter ultimately reverses the European Commission's adequacy determination and upends the 2023 Data Privacy Framework (DPF), U.S. businesses could find themselves returning to the legally uncertain environment that followed the 2020 Schrems II decision.
Without the DPF, U.S. companies could no longer self-register under the framework and will, instead, have to return to Article 46 mechanisms such as Standard Contractual Clauses and the binding corporate rules to transfer personal data out of Europe. This could also mean that U.S. businesses will spend more time preparing “transfer impact assessments” (TIAs) and negotiating data protection terms with individual vendors and customers.
While the fate of the existing framework remains to be seen, it is clear that old debates and considerations for EU-U.S. data transfers have been resurrected. For businesses that rely on transatlantic data flows, that uncertainty alone warrants close attention.
