US Supreme Court just blew up EU–US data transfers: what it means for the EU–US Data Privacy Framework

The EU–US Data Privacy Framework (DPF) allows personal data to move from the EU to certified US recipients on the basis that US protections are “adequate” under EU standards. It is the latest attempt at a transatlantic data-transfer arrangement after the EU–US frameworks previously failed in court.

This new pressure point comes from a US Supreme Court ruling (described by privacy advocates as Trump v. Slaughter), which concluded that the FTC may not be constitutionally “independent.” The argument in Europe is that EU law requires independent oversight for data-protection enforcement mechanisms used to justify an adequacy decision. Because the European Commission’s DPF logic relies heavily on the FTC’s role, losing that independence could unravel key assumptions underpinning the adequacy finding.

Privacy groups say this is not a minor procedural change. They contend the EU legal framework depends on independence as an essential condition for equivalent protection, and that the Commission has relied on the FTC across a large share of the DPF’s enforcement landscape. They also argue that the DPF’s broader enforcement structure is tied to US institutional arrangements whose continued independence can’t be taken for granted.

In practice, the most immediate effect may be uncertainty rather than an automatic shutdown. Even if the Supreme Court decision strengthens arguments for challengers, the EU adequacy decision formally remains in force until it is withdrawn or invalidated by the EU courts. That said, legal risk for organisations transfers personal data to the US is likely to rise: regulators and courts may increasingly scrutinise whether any reliance on the DPF remains sustainable, and firms may be pushed to update transfer-risk assessments and contingency planning.

The potential downstream impact could also extend beyond direct DPF reliance. Many organisations use supplementary transfer mechanisms and conduct “impact” or risk assessments that, in turn, rest on the effectiveness of US oversight and remedies. If those oversight pillars are challenged, the assessments that depend on them may need to be revisited.

Overall, the ruling reopens the most litigated vulnerability in EU–US data transfers: whether US protections are sufficiently equivalent in practice, including the independence and effectiveness of oversight and redress. For companies moving EU personal data to the US, the headline is clear—expect increased legal and compliance scrutiny, and plan for renewed courtroom battles over the DPF’s foundation.