Data Privacy Framework Faces Scrutiny After U.S. Supreme Court Ruling on FTC Independence
The European Data Protection Board (EDPB) has raised formal concerns regarding the impact of the U.S. Supreme Court’s decision in Trump v. Slaughter on the EU-U.S. Data Privacy Framework (DPF). The EDPB has requested the European Commission to carefully evaluate how this ruling could affect the Federal Trade Commission’s (FTC) independence and its ability to enforce the commitments made under the DPF. According to EDPB Chair Anu Talus, the presence and effective operation of independent supervisory authorities in third countries is a critical factor when assessing whether the level of data protection is adequate.
The DPF explicitly references the FTC’s independence, including provisions that the U.S. President can only remove an FTC commissioner for reasons such as inefficiency, neglect of duty, or malfeasance. However, the Supreme Court ruling challenges this independence, given that former President Donald Trump removed FTC Commissioner Rebecca Kelly Slaughter for reasons related to her policy positions, which contradicts the DPF’s commitments. This situation has prompted the EDPB to seek clarity from the European Commission on whether the current framework still meets the required standards.
Reactions to the ruling vary. Some experts argue that despite the ruling, other data transfer mechanisms like Standard Contractual Clauses (SCCs) and Binding Corporate Rules (BCRs) remain valid options for EU-U.S. data transfers. However, many businesses continue to rely heavily on the DPF. Max Schrems, a prominent privacy advocate, views the ruling as a fundamental constitutional clash that undermines the independence promised under the DPF and raises concerns about potential political interference. Schrems and his organization NOYB are reportedly preparing a legal challenge to bring the matter before the Court of Justice of the European Union (CJEU).
On the other hand, some legal experts, including former FTC privacy head Maneesha Mithal, believe the FTC remains committed to enforcing privacy protections and that the ruling may not significantly affect other data transfer mechanisms. Additional analysis by legal scholars suggests that the Trump v. Slaughter decision does not uniformly impact the DPF’s redress mechanisms. The European Commission has yet to publicly respond to the EDPB’s request, while Commissioner Michael McGrath has previously emphasized the mutual benefits of the DPF for both the EU and U.S. as discussions continue.
