A U.S. Supreme Court ruling that permits the president to dismiss members of independent federal agencies without cause is threatening the legal foundation of the EU-US Data Privacy Framework (DPF), the agreement that governs personal data transfers from the European Union to U.S. companies.
The Legal Trigger
On Monday, the Supreme Court upheld President Donald Trump’s dismissal of FTC Commissioner Rebecca Slaughter, ruling that the action was lawful. The decision calls into question the institutional independence of the Federal Trade Commission, which has served as the primary U.S. oversight body under the DPF. The European Commission cited the FTC’s independence in at least 259 data flow determinations made under the current framework, according to noyb founder Max Schrems.
Schrems Moves to Invalidate the DPF
In a letter sent Tuesday to European officials, Schrems announced plans to file suit seeking to invalidate the DPF. Schrems, who previously succeeded in dismantling two earlier transatlantic data transfer arrangements, framed the situation bluntly: the framework’s legal basis is no longer viable given that the FTC can no longer be considered independent of executive influence.
Schrems called on the European Commission to begin an orderly transition away from U.S. cloud infrastructure, acknowledging the difficulty but describing it as unavoidable under the current legal reality.
Institutional Responses
The European Commission did not issue a formal public response, though spokesperson Markus Lammert told Politico Europe the Commission has noted the ruling and will analyze its implications. The European Data Protection Board, composed of national privacy regulators across the EU, said it is reviewing the decision and its potential impact on DPF oversight mechanisms. The EDPB described the independence of U.S. oversight bodies as a matter of central importance to the framework’s legitimacy, though the body lacks authority to unilaterally suspend or revoke the DPF.
French parliamentarian Philippe Latombe, who already has a case pending before the Court of Justice of the EU challenging the DPF, called on Commission President Ursula von der Leyen to immediately cancel the agreement.
Economic Stakes and Industry Exposure
The DPF underpins an estimated 1.7 trillion euros in annual transatlantic trade. Companies such as Meta and Google have previously indicated they would curtail European operations if data transfers to the U.S. were no longer permitted. Approximately a quarter of Meta’s advertising revenue originates from the EU, and any restriction on using European user data for ad targeting would require either building local data infrastructure or navigating a complex compliance environment without a clear path to profitability.
Building that kind of infrastructure is neither fast nor cheap. TikTok’s ongoing effort to establish data centers in Ireland has taken years and exceeded 10 billion dollars in cost, according to IAPP research director Joe Jones.
A Narrowing Path for the Commission
Legal and policy analysts say the Commission has little room to maneuver. It cannot reasonably dispute the Supreme Court’s interpretation of U.S. law, which means it must either justify why a lack of FTC independence is acceptable under the DPF or acknowledge that the framework’s oversight mechanism is compromised. Either position carries significant legal and political risk. A court ruling on Schrems’ new challenge could take years, during which data transfers would continue unless a court orders a suspension.