EU-US Data Privacy Framework at Risk After Supreme Court Strips FTC Independence

The EU-US Data Privacy Framework — the transatlantic data transfer mechanism adopted in 2023 and extended to the EEA in 2024 — faces a renewed adequacy challenge following the US Supreme Court's June 29, 2026 decision in Trump v. Slaughter, which held that the FTC's statutory removal protections are unconstitutional and that FTC commissioners must be removable by the president at will. The DPF's adequacy decision relied in part on the FTC serving as an independent US oversight body; Skadden's July 28 analysis warned that the ruling "could increase the risk that European courts will overturn the European Commission's 2023 adequacy decision." If a European court — most likely the CJEU following a referral — invalidates the DPF adequacy decision, data transfers from the EU to the US would immediately require alternative safeguards (Standard Contractual Clauses, Binding Corporate Rules), as happened after Schrems I in 2015 and Schrems II in 2020. Law firms advising technology companies, financial services clients, and any business with EU operations and US data infrastructure should be updating their data transfer contingency plans now — before a CJEU ruling materializes.