A U.S. Supreme Court ruling that permits the president to remove members of independent federal agencies without cause has placed the EU-US Data Privacy Framework (DPF) in serious legal jeopardy, prompting privacy advocates and European officials to call for its suspension or outright cancellation.
The Legal Trigger
On Monday, the Supreme Court upheld President Donald Trump’s dismissal of FTC Commissioner Rebecca Slaughter, ruling that the firing was legally permissible. The decision directly undermines the independence of the Federal Trade Commission, which has served as the primary oversight body for transatlantic data transfers under the DPF. According to privacy advocate Max Schrems, founder of the Vienna-based nonprofit noyb, the European Commission cited FTC independence in 259 separate data flow decisions under the current framework.
In a letter sent Tuesday to European officials, Schrems announced plans to sue to invalidate the DPF, describing the framework’s legal foundation as collapsed. “The basis for any EU-US data transfer deal is dead,” Schrems said in a public statement, urging the Commission to begin “an orderly exit from the U.S. cloud.”
Institutional Reactions
The European Commission, which adopted the DPF in 2023 to address concerns over U.S. surveillance practices, has not issued a formal response. Spokesperson Markus Lammert told Politico Europe that the Commission has “taken note” of the ruling and will “carefully analyze any implications it may have for the EU-US agenda.”
The European Data Protection Board (EDPB), representing privacy regulators across EU member states, stated Tuesday that it is reviewing the Supreme Court decision and its potential impact on the oversight mechanisms underpinning the DPF. The EDPB described FTC independence as a matter of “central importance” to the framework’s legitimacy. While the EDPB lacks authority to overturn the DPF unilaterally, its views carry significant weight with the Commission.
French parliamentarian Philippe Latombe, who already has a case pending before the Court of Justice of the EU seeking to invalidate the DPF, called on European Commission President Ursula von der Leyen to “immediately cancel” the agreement, describing it as no longer legally viable.
Economic Stakes
The DPF underpins approximately 1.7 trillion euros (roughly $1.9 trillion) in annual transatlantic trade. Meta and Google have previously stated they would consider pulling out of Europe if data transfers to the United States are no longer permitted. Analysts note that roughly a quarter of Meta’s advertising revenue originates from the EU, creating strong commercial pressure on both sides.
Joe Jones, director of research and insights at IAPP, characterized the Commission’s position as politically untenable. “The commission cannot come to a different interpretation of U.S. law than the U.S. Supreme Court,” Jones said, adding that it faces pressure to either justify the absence of FTC independence or acknowledge the problem and act accordingly.
Building alternative data infrastructure is no straightforward remedy. TikTok’s ongoing effort to construct data centers in Ireland has taken years and exceeded $10 billion in cost, illustrating the scale of what U.S. cloud-dependent companies would face if the DPF is invalidated. Schrems is pressing for the suspension of data transfers pending a court ruling, a process that could take several years to resolve.