Share on LinkedInShare on LinkedIn

ARTICLE · 10 AUGUST 2026

EU-US Data Privacy Framework Under The Spotlight Following FTC Independence Ruling

K&L Gates
K&L Gates
Contributor
K&L Gates

K&L Gates

The Firm K&L Gates is an integrated, international law firm. As a single global law firm, truly...

View firm profile
Explore more from K&L Gates

The European Data Protection Board has asked the European Commission to evaluate how a recent US Supreme Court ruling on presidential authority to dismiss FTC commissioners may affect the EU-US Data Privacy Framework. The decision raises questions about the independence of the Federal Trade Commission, a key pillar underpinning the European Commission's adequacy determination that allows personal data transfers between the EU and participating US organisations.

WorldwidePrivacy
Sarah  Pearce
Sarah Pearce
Sophie Verstraeten
Sophie Verstraeten

The European Data Protection Board (EDPB) has called on the European Commission to assess the implications of the recent US Supreme Court decision in Trump v. Slaughter for the EU-US Data Privacy Framework (DPF), the mechanism that facilitates transfers of personal data between the EU and participating US organisations.

The EDPB’s request follows the Supreme Court’s decision, handed down at the end of June, which held that the US President may dismiss Federal Trade Commission (FTC) commissioners without cause. The ruling has raised questions about the independence of the FTC.

These concerns stem from the fact that the European Commission’s 2023 adequacy decision, which found that the United States ensures an adequate level of protection for personal data, relies in part on the FTC operating as an independent supervisory authority. The adequacy decision specifically notes that FTC commissioners may be removed by the President only for inefficiency, neglect of duty, or malfeasance.

According to the EDPB, a key factor in assessing whether a third country provides an adequate level of data protection is the existence and effective functioning of one or more independent authorities responsible for supervising compliance with data protection requirements. In light of the uncertainty surrounding the FTC’s independence, the potential impact of the Supreme Court’s decision on the EU-US DPF remains unclear.

For now, organisations may continue to rely on the EU-US DPF as a valid mechanism for transferring personal data from the EU to the United States. Alternative transfer mechanisms, including Standard Contractual Clauses (SCCs) and Binding Corporate Rules (BCRs), also remain available and lawful.

The European Commission’s assessment will be closely watched by businesses that rely on the framework for transatlantic data transfers. The Commission’s conclusions may provide important clarity on the future stability of the DPF and the wider EU-US data transfer landscape.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

See more popular content from