FTC independence ruling raises fresh questions over EU-U.S. data privacy deal

Published August 6, 2026

Score

Why it matters

On June 29, 2026, the U.S. Supreme Court held in Trump v. Slaughter that the president may remove Federal Trade Commission commissioners at will, eliminating the statutory protections that had shielded agency leadership from political pressure for decades. The ruling does not automatically void the EU-U.S. Data Privacy Framework, the transatlantic mechanism that permits companies to transfer personal data from Europe to the United States. But it has destabilized the legal foundation on which the European Commission built its 2023 adequacy decision—a determination that explicitly relied on FTC independence as a safeguard for European data subjects.

The European Data Protection Board has requested that the Commission reassess the framework's viability in light of the Supreme Court decision. No court has yet challenged the DPF's validity, and transfers under it remain lawful for now. Legal analysis is divided on whether the ruling materially weakens the Commission's original adequacy rationale, but the uncertainty is real and unresolved.

For multinational companies, the stakes are immediate. The DPF governs data flows for cloud infrastructure, human resources systems, advertising platforms, and regulatory compliance across thousands of U.S.-based service providers. A formal reassessment or invalidation of the framework would force companies to identify alternative transfer mechanisms—a costly and operationally disruptive exercise. Counsel should monitor European Commission guidance and EDPB decisions closely, and begin contingency planning for data localization or contractual safeguards outside the DPF.