US Supreme Court Ruling Collapses the Legal Foundation for EU-US Data Transfers

A Supreme Court ruling in Trump v. Slaughter declared the FTC's independence unconstitutional — and with it, the EU's entire legal basis for allowing free data flows to the United States, hinging on FTC oversight cited 259 times in the EU-US Data Privacy Framework.

On Monday, the US Supreme Court handed down a decision that reaches far beyond American administrative law. In Trump v. Slaughter, the conservative majority ruled that the Federal Trade Commission's independence structure is unconstitutional under the "unitary executive theory" — the President must have direct control over all executive agencies.

The ruling itself is about separation of powers. But its shockwave hit Brussels within hours.

Since 2000, the European Union has relied on the FTC as the independent privacy watchdog that makes data transfers to the US legally permissible. Under EU treaty law — specifically Article 16(2) TFEU and Article 8(3) of the Charter of Fundamental Rights — any third country receiving EU personal data must provide oversight by an independent authority. The FTC was that authority. The European Commission cited it 259 times in its 2023 adequacy decision approving the EU-US Data Privacy Framework.

That framework was already the third attempt. The Court of Justice of the EU struck down Safe Harbour in 2015 and Privacy Shield in 2020, both times because of US surveillance laws and lack of judicial remedies. The 2023 Data Privacy Framework was largely a repackaged version — and now its single load-bearing pillar has been declared unconstitutional.

Max Schrems, the Austrian privacy activist whose legal challenges brought down the first two frameworks, wasted no time: "Given that there are no independent authorities in the US anymore, we call on the European Commission to orderly withdraw the adequacy decision on the US." He added: "The Commission built a legal house of cards under industry pressure. Now that it clearly collapses, it has to take responsibility."

The practical stakes are enormous. Thousands of EU companies run on US cloud infrastructure — AWS, Azure, Google Cloud. Every GDPR-compliant data transfer to the US now rests on a legal foundation that no longer exists in any meaningful sense. The European Commission could theoretically ignore the ruling or negotiate a new arrangement, but the constitutional requirement for independent oversight cannot be waived without a unanimous treaty change by all 27 EU member states.

For the third time in a decade, the transatlantic data bridge has collapsed. And this time, it wasn't the EU court that pulled the trigger — it was the US Supreme Court.

Sources: SCOTUSblog, noyb,