The Commission is analyzing whether the decision of the U.S. Supreme Court regarding the independence of federal authorities affects data transfers with the EU.

The European executive is examining the possible consequences of the Trump v. Slaughter ruling, through which the U.S. Supreme Court invalidated the protection against the removal of a member of the Federal Trade Commission. The Commission has not yet identified any impact on the framework that allows the transfer of personal data to participating U.S. companies.

The European Commission has begun to analyze whether the U.S. Supreme Court ruling that expands the president's power to remove members of the Federal Trade Commission may have consequences for the framework used for the transfer of personal data from the European Union to participating U.S. companies.

In short
The ruling under review concerns the legal protection that limited the ability of the U.S. president to remove a member of the Federal Trade Commission, the authority responsible for enforcing the commitments made by companies participating in the transatlantic data framework.

The Commission stated that it is examining the decision and how it will be implemented, without concluding that data transfers are affected or that the adequacy decision needs to be modified.

The framework adopted in July 2023 allows the transfer of data from the EU to participating U.S. companies without the requirement of introducing additional safeguards for each transfer.

The European Commissioner for Democracy, Justice, Rule of Law, and Consumer Protection, Michael McGrath, discussed the framework with the chair of the Federal Trade Commission and a member of the Privacy and Civil Liberties Oversight Board during a visit to Washington.

The Commission continuously monitors the adequacy decision and can intervene if legal or institutional changes in the United States reduce the level of protection on which the European assessment was based.

The spokesperson for the Commission for Justice and Consumer Protection confirmed in a press briefing on July 23 that the European executive has taken note of the U.S. Supreme Court ruling in the Trump v. Slaughter case and that it will carefully analyze how it is implemented.

"We have taken note of the U.S. Supreme Court's decision in the Trump v. Slaughter case. We will carefully analyze any enforcement measures and their potential implications for our agenda with the United States," said the spokesperson.

The Commission did not state that the ruling already affects personal data transfers and has not announced a formal reassessment or a procedure for suspending the transatlantic framework. The analysis is at an initial stage, and the institution has not provided a timeline for its completion.

The U.S. Supreme Court ruled that the norm allowing the removal of a member of the Federal Trade Commission only for certain reasons is incompatible with the separation of powers provided by the U.S. Constitution. The ruling strengthens the president's control over the composition of the federal authority's leadership.

The Federal Trade Commission has a direct role in the functioning of the commercial component of the EU–U.S. data protection framework. The authority can verify compliance with the commitments made by U.S. companies written in the system and can intervene when a company claims to comply with the framework's requirements but does not implement them in practice.

The possible relevance for the EU arises from the need for the enforcement and control mechanisms on which the adequacy decision relies to continue functioning effectively. The Commission must verify both the existence of U.S. norms and the capacity of the responsible institutions to enforce them independently and effectively.

However, the European executive has not established that the possibility of removing members of the Federal Trade Commission automatically reduces the protection of data transferred from the EU. Such a conclusion would require examining the legal and practical consequences of the ruling, how the authority conducts its activities, and any measures adopted by the U.S. administration.

In July 2023, the Commission decided that the United States provides an adequate level of protection for data transferred to U.S. companies participating in the EU–U.S. Data Privacy Framework. The decision allows European organizations to transfer data to these companies without having to establish additional mechanisms for each operation, such as standard contractual clauses.

The framework does not automatically cover all companies in the United States. Companies must enroll and commit to comply with requirements regarding data use, purpose limitation of processing, data retention, security, and the exercise of the rights of data subjects.

The Federal Trade Commission and the Department of Transportation enforce the obligations of participating companies, depending on the sector in which they operate. Individuals whose data are transferred also benefit from mechanisms for filing complaints and resolving disputes.

A separate component concerns U.S. authorities' access to data for national security purposes. The United States has introduced requirements stating that intelligence activities must respect the principles of necessity and proportionality and has created a mechanism for individuals in the EU to contest.

The Privacy and Civil Liberties Oversight Board is part of the U.S. oversight structure for activities related to national security and privacy protection. It does not have the same role as the Federal Trade Commission and was not the institution directly targeted by the Trump v. Slaughter ruling.

The Commission, however, monitors the situation of both bodies as the transatlantic framework relies on multiple levels of protection. The Federal Trade Commission is relevant for the compliance of companies with commercial obligations, while oversight bodies and appeal mechanisms are relevant for U.S. public authorities' access to data.

European Commissioner for Democracy, Justice, Rule of Law, and Consumer Protection, Michael McGrath, met in Washington with the chair of the Federal Trade Commission, Andrew Ferguson, and with Beth Williams, a member of the Privacy and Civil Liberties Oversight Board.

According to the Commission, McGrath discussed the EU–U.S. framework with the two representatives and emphasized the need to strengthen transatlantic cooperation in the field of data protection, both for citizens and for companies.

The visit took place a few weeks after the Supreme Court ruling was pronounced. The Commission did not specify whether U.S. authorities provided additional guarantees regarding institutional independence, continuity of oversight activities, or the concrete effects of the decision.

The spokesperson reminded that the European decision from July 2023 concluded that the United States provides an adequate level of protection for data transferred under the system. He added that, like all adequacy decisions, this one is monitored to verify whether the level of protection is maintained.

The first periodic evaluation of the framework was conducted in 2024. The analysis focused on the application of requirements by participating companies, the activities of U.S. authorities, the functioning of appeal mechanisms, and relevant legal changes regarding governmental access to data.

Monitoring is not limited to scheduled periodic evaluations. The Commission can analyze at any time legislative developments, court rulings, institutional changes, and practices of U.S. authorities that could alter the level of protection considered at the time of the decision's adoption.

If it finds that the United States no longer provides the necessary protection, the Commission could request remedial measures and could modify, suspend, or withdraw the adequacy decision. None of these steps have been announced in connection with the Trump v. Slaughter ruling.

Transfers made under the framework continue to be permitted. Companies can also use other tools provided by European regulations, such as standard contractual clauses and binding corporate rules, depending on their situation.

The current framework was adopted after the Court of Justice of the European Union invalidated the previous mechanism, known as the Privacy Shield, in 2020. The European court then found that the protections regarding U.S. authorities' access to data and the available remedies for individuals in the EU were insufficient.

The United States subsequently introduced new guarantees regarding intelligence activities and a remedy mechanism for individuals in the EU. The Commission considered that these changes allow for the resumption of transfers based on a new adequacy decision, but the functioning of the system remains subject to monitoring.