Following the Supreme Court’s ruling in Trump v. Slaughter ( June 29, 2026), the U.S. Federal Trade Commission (FTC) loses its independence: The court ruled, in accordance with the “unitary executive” doctrine, that the President’s authority to issue directives extends to all agencies of the executive branch.
This strikes at the heart of the EU-U.S. Data Privacy Framework. The European Commission’s adequacy decision relies heavily on independent oversight of data protection in the U.S.: The FTC is mentioned over 250 times in the decision. Under EU law, a third country must offer a “substantially equivalent” level of protection, which explicitly includes independent supervisory authorities. It is precisely this fundamental assumption that is now being undermined.
In the short term, nothing will change legally: The adequacy decision remains in effect until it is revoked or declared null and void by a court. Transatlantic data transfers based on this decision remain permissible for the time being. However, the legal basis is once again uncertain. noyb has already formally called on the European Commission to “orderly” withdraw the decision and has announced that it will file a lawsuit before the European Court of Justice. Experience shows that such proceedings typically take two to three years.
Click here for the noyb article: U.S. Supreme Court Just Shattered EU-U.S. Data Transfers