On June 29, the US Supreme Court ruled in Washington that President Donald Trump could dismiss Federal Trade Commission (FTC)commissioners without cause, a decision that may weaken the independent oversight supporting EU-US data transfers agreement under the Data Privacy Framework (DPF).
The ruling has quickly become a compliance matter for companies across the Atlantic. If European regulators decide that US oversight is no longer independent enough, businesses will need new legal tools or data infrastructure to keep information moving between the US and Europe.
Supreme Court Ruling Puts the DPF Under Pressure
In Trump v. Slaughter, the Supreme Court ruled six to three that limits on the President’s power to remove FTC commissioners were unconstitutional.
The case followed Trump’s dismissal of FTC Commissioner, Rebecca Slaughter, along with Alvaro Bedoya, without using the traditional grounds of inefficiency, neglect of duty, or misconduct.
Chief Justice, John Roberts, based the majority opinion on the idea that executive agencies must remain under presidential control, weakening a long-standing model that allowed Congress to protect some regulators from political dismissal.
The EU-US Data Privacy Framework, adopted in 2023, allows personal data to move from Europe to certified US companies without separate transfer approvals. More than 5,300 US organizations use the system, including cloud, advertising, software and technology providers.
The FTC is essential because it enforces compliance for most companies certified under the framework. EU law, however, requires personal data rules to be supervised by an independent authority.
Privacy activist, Max Schrems, argues that the ruling breaks that condition.
“The basis for any EU-US data transfer deal is dead,” said Schrems, adding, “We call upon the Commission to start an orderly exit from the US cloud, which is not easy, but unfortunately unavoidable.”
Schrems also added that the Commission built a legal house of cards under industry pressure. Now that it clearly collapses, it has to take responsibility.
Tech Companies Face Another Transatlantic Data Test
Schrems’ organization, noyb, says it is preparing a new legal challenge before the Court of Justice of the EU. Schrems previously helped overturn Safe Harbour in 2015 and the Privacy Shield in 2020, forcing companies to rebuild legal arrangements for data transfers agreement.
The DPF supports an estimated $1.97 trillion (€1.7 trillion) in annual transatlantic trade. Major platforms such as Meta and Google depend on moving and processing European data in US-based systems.
If the framework collapses, technology companies may have to expand European data centers, redesign cloud architecture, rely more heavily on Standard Contractual Clauses, or separate European user data from US systems.
According to Joe Jones, IAPP research director, Meta could face particular pressure because roughly a quarter of its advertising revenue comes from the EU. Without easy access to European data for ad targeting, the company could need more regional storage and processing capacity.
TikTok shows how expensive that shift can become. Its European data-storage programme in Ireland has required years of work and more than $10 billion in spending.
The European Commission has said it has taken note of the ruling, while the European Data Protection Board is reviewing the potential implications for the oversight mechanisms underpinning the EU-US Data Privacy Framework.
For now, the DPF remains valid. But companies using US cloud providers may need backup mechanisms before another ruling turns uncertainty into an infrastructure problem.
Inside Telecom provides you with an extensive list of content covering all aspects of the tech industry. Keep an eye on our Tech sections to stay informed and up-to-date with our daily articles.
