Why We Keep Doing This Dance
For decades, the process of moving personal data from the EU to the US, commonly known as EU-US data transfers, has presented significant legal challenges. EU law, specifically Article 16(2) TFEU and Article 8(3) of the Charter of Fundamental Rights, demands oversight from an independent authority for personal data protection. Since 1995, the EU has largely blocked exporting personal data to countries that don't meet its privacy standards, leading to a complex history of agreements and annulments.
The US has tried to bridge this gap three times: first with "Safe Harbour," then "Privacy Shield," and most recently, the EU-US Data Privacy Framework (DPF) from 2023. The European Court of Justice (CJEU) annulled the first two deals, "Safe Harbour" and "Privacy Shield," citing US surveillance laws and the lack of independent judicial remedies for EU citizens. The third deal, the EU-US Data Privacy Framework from 2023, was largely a copy of these annulled deals, and its basis has now collapsed following the Supreme Court's ruling. This creates significant uncertainty for all EU-US data transfers, even though the DPF remains formally in force until repealed by the European Commission or annulled by the CJEU.
The FTC Was the Linchpin
To meet the EU's demand for independent oversight, the US named the FTC as its privacy regulator. The European Commission repeatedly emphasized the FTC's supposed independence when it deemed the US "adequacy" for data protection. The FTC served as a foundational element supporting the entire DPF structure; its absence would compromise the framework's integrity, directly impacting the legality of EU-US data transfers.
The Supreme Court's recent decision in *Trump v. Slaughter*, by re-examining the constitutional limits of agency independence, has cast doubt on the FTC's foundational role within the DPF. This means a core factual assumption behind the EU's adequacy decision for the DPF has completely shifted. The EU's constitutional requirements for independent oversight haven't changed, and they can't without a unanimous vote from all EU Member States.
Beyond this, the CJEU also demanded the US provide an independent legal redress mechanism for government surveillance. The Biden Administration attempted to address this with a "Data Protection Review Court" via Executive Order. But this "Court" is an executive body within the US Justice Ministry, not truly independent, and any President can alter it. This was already a weak point, and the Supreme Court's ruling only amplifies the wider problem of executive control, further complicating the future of EU-US data transfers.
What This Means for Your Business
For now, the EU-US Data Privacy Framework technically remains in force. The European Commission's decision (EU 2023/1795) is still legally valid until the EC repeals it or the CJEU annuls it. So, no immediate, official order exists to stop EU-US data transfers under the DPF.
However, the underlying legal landscape has significantly changed. Privacy advocates like Max Schrems and noyb (None of Your Business) are already moving. noyb sent a formal letter to the European Commission on June 29, 2026, asking for an orderly withdrawal of the DPF. They've also announced plans to file a lawsuit in the coming weeks to challenge the framework in the CJEU, a process that could take 2-3 years for a final decision. A widespread sentiment suggests this framework is legally precarious, and a "Schrems III" challenge is highly anticipated, directly impacting the stability of EU-US data transfers.
This ruling extends beyond companies relying solely on the DPF. Businesses using Standard Contractual Clauses (SCCs) and Binding Corporate Rules (BCRs) for EU-US data transfers also face heightened scrutiny. These mechanisms demand companies conduct "transfer impact assessments" (TIAs) to evaluate data protection in the destination country. Those TIAs often hinged on the perceived independence of US executive bodies like the FTC or the Data Protection Review Court. Now, companies must update these assessments, a process that will inevitably lead to a re-evaluation of the legal basis for many existing EU-US data transfers. Many will logically conclude that data transfers to the US are no longer legal under these mechanisms either, given the compromised independence of US oversight bodies.
The ripple effect of this decision is profound. Organizations that have invested heavily in DPF certification or relied on the framework for their EU-US data transfers will need to pivot quickly. The legal and reputational risks of non-compliance are substantial, including potential fines under GDPR and a loss of customer trust. This necessitates not just a legal review, but a strategic re-assessment of global data processing operations, especially for those with significant EU customer bases or operational ties.
Navigating the Path Forward for EU-US Data Transfers
The legal uncertainty surrounding EU-US data transfers is now immense. While the EU-US Data Privacy Framework (DPF) isn't immediately invalid, the underlying factual basis for its existence has been severely compromised. The European Commission could determine no material effect or initiate a formal review, but the intensifying calls for action from privacy advocates suggest businesses cannot afford to wait passively. The precedent set by the annulment of Safe Harbour and Privacy Shield underscores the fragility of such agreements when core legal assumptions are challenged.
For any organization involved in EU-US data transfers, the immediate priority is to review current cross-border data transfer strategies and initiate robust contingency planning. This involves a comprehensive audit of all data flows from the EU to the US, identifying which mechanisms are currently in use (DPF, SCCs, BCRs) and assessing their vulnerability. The significant shift in the legal landscape necessitates prompt, proactive engagement rather than a reactive stance. This isn't merely about compliance; it's about ensuring operational continuity and mitigating future legal exposure in a rapidly evolving regulatory environment.
A critical next step involves re-evaluating Transfer Impact Assessments (TIAs) for mechanisms like Standard Contractual Clauses (SCCs) and Binding Corporate Rules (BCRs). Given the Supreme Court's ruling on agency independence, it becomes exceedingly difficult to credibly argue that US independent oversight now meets the stringent EU standards. Previous TIAs, which often relied on the perceived independence of bodies like the FTC or the Data Protection Review Court, are likely outdated and require immediate revision to reflect this new reality. Companies must now consider the heightened risk of surveillance and the lack of effective redress for EU data subjects when conducting these crucial assessments for EU-US data transfers.
While monitoring guidance from the European Commission, the European Data Protection Board (EDPB), and national supervisory authorities remains essential, organizations should also proactively explore alternatives. Their forthcoming guidance will certainly shape the immediate future, but a forward-looking strategy demands more than just observation. This includes engaging with legal counsel specializing in data protection to understand the specific implications for their sector and operational footprint.
This includes a thorough evaluation of vendor contracts to identify alternative transfer mechanisms. For instance, exploring options for data processing within the EU, or utilizing robust encryption and pseudonymization techniques that render data unintelligible outside the EU, could become vital. Furthermore, businesses should seriously consider broader data localization strategies. The trend towards "digital sovereignty" is gaining momentum among many EU Member States, and some US service providers are already adapting by moving towards separate EU data processing. This evolution is transforming from a strategic option into a practical necessity for many businesses navigating the complexities of EU-US data transfers.
Ultimately, the Supreme Court's decision has underscored the inherent risks of relying on the EU-US Data Privacy Framework as a stable, long-term solution for EU-US data transfers. Businesses should now prepare for a future where transatlantic data flows demand more robust, often localized, solutions, rather than anticipating yet another temporary arrangement. This moment calls for strategic foresight and decisive action to secure data flows in a fundamentally altered legal environment, ensuring compliance and maintaining trust with EU customers and regulators.
