Key takeaways:
- The decision in Trump v Slaughter has created uncertainty about the long-standing position of the independence of the Federal Trade Commission (FTC) in the USA.
- Max Schrems (who has previously challenged the data transfer protections in place between the EU and USA) considers the decision in Trump v Slaughter to remove the independence of the FTC required under the Data Privacy Framework (DPF). Schrems's NGO "NOYB" has urged the European Commission to act, and threatened to bring proceedings if necessary.
- The DPF remains in place for now, though it is possible that a Schrems III action will invalidate the DPF should the Court of Justice of the European Union (CJEU) agree with the position in Schrems's submissions. Should that happen, it seems inevitable that the UK-US "data bridge", which relies on the DPF, would be reviewed.
Trump v Slaughter decision
The Federal Trade Commission (FTC) is a US government regulatory agency, which has a variety of powers relating to the enforcement of competition law and consumer protection. The FTC operates with five Commissioners, who serve for a period of seven years following their appointment and historically it has only been possible to remove them from office following "inefficiency, neglect of duty, or malfeasance in office". Until recently, it enjoyed statutory protection designed to ensure its independence.
In his second term as President, Donald Trump removed Commissioners Alvaro Bedoya and Rebecca Slaughter from their roles. Slaughter subsequently challenged this decision in the courts, and the case was eventually heard by the US Supreme Court. On 29 June 2026, the Court ruled in Trump v Slaughter that the President could fire Commissioners "at will" and was not restricted to the historic position relating to their conduct in office. The decision discusses at length the position of the FTC, and whether it exercises executive power (and therefore falls under the authority of the President) and ultimately concludes that it does – hence the President's ability to appoint and remove Commissioners without cause.
Max Schrems's view
Max Schrems is an Austrian lawyer and founder and Chair of NOYB, known for his complaints to the Irish Data Protection Commissioner that ultimately resulted in the landmark rulings by the CJEU on the validity of the adequacy decisions made by the European Commission for EU-US personal data transfers. These decisions were reliant on the "EU–US Safe Harbor" regime which was invalidated in the case known as Schrems I and the adequacy decision reliant on the "EU–US Privacy Shield" which was invalidated in the case known as Schrems II.
Both Schrems I and II resulted in a change to the approach that was necessary to transfer personal data between the EU and US in a GDPR-compliant manner.
Following the Trump v Slaughter decision, NOYB has stated its belief that the current "EU–US Data Privacy Framework" (DPF) used for transatlantic data transfers is invalid as the FTC (which is designated to independently enforce the DPF commitments of certified organisations) is no longer independent in the manner intended by the European Commission. In its statement, NOYB critiques not only the DPF, but also the ability to rely on EU SCCs or BCRs, as both rely on transfer impact assessments (TIAs) which NOYB believes should conclude the transfers are no longer legal. NOYB has also written to the European Commission, urging it to repeal the adequacy decision which approves the DPF, and threatening legal action if necessary.
Is Schrems right? Where do EU-US Transfers stand?
For the time being, at least, the European Commission adequacy decision still stands and relies on the DPF and assumed independence of the FTC.
It is unlikely that the European Commission will repeal its adequacy decision of its own volition. And if the matter does come before the CJEU, any decision is likely several years away. In the meantime, those businesses who rely on the DPF should generally feel confident that they can do so, awaiting a decision by the CJEU.
UK businesses should also be aware of the potential impact on the UK-US Data Bridge. The data bridge, which came into effect on 12 October 2023, is a UK extension to the DPF: US organisations must first be certified under the DPF in order to participate. Accordingly, if the underlying DPF were to be invalidated by the CJEU, the legal foundation of the data bridge would be called into serious question. However, since the threshold for adequacy was lowered from "essentially equivalent" to "not materially lower", the UK government might continue to allow US-UK data flows.
For businesses reliant on SCCs and BCRs, there is certainly some force in NOYB's position, and TIAs may need to be revised and updated. However, as with transfers to other countries not subject to an adequacy decision, both the SCCs and BCRs remain appropriate transfer mechanisms.