- What’s new:On June 29, 2026, the U.S. Supreme Court issued a significant separation-of-powers decision inTrump v. Slaughter, holding that the Federal Trade Commission’s statutory for-cause removal protections are unconstitutional and that FTC commissioners must be removable by the president at will.
- Why it matters:The decision could increase the risk that European courts will overturn the European Commission’s 2023 “adequacy decision” authorizing transfers of personal data from the EU to the U.S., as that decision relied in part on the FTC’s role as an independent U.S. oversight authority.
- What to do next:To the extent that companies were leveraging the EU-U.S. Data Privacy Framework for transfers, they should consider reviewing their fallback arrangements should the Commission’s adequacy decision be annulled in the future.
The European Union’s General Data Protection Regulation (GDPR) generally prevents the transfer of personal data from the EU to foreign countries unless:
- The European Commission (the Commission) has issued a decision identifying the recipient country as having “adequate” protections for personal data and having regard to factors including the “effective functioning of … independent supervisory authorities … enforcing compliance with the data protection rules”1; or
- Appropriate safeguards are in place to ensure the recipient respects GDPR rights, usually in the form of the Commission’s standard contractual clauses (SCCs).
In 2023, the Commission issued a decision (the 2023 Decision) identifying the U.S. as having “adequate” protection for personal data, but only for companies that participate in the EU’s Data Privacy Framework (DPF).2
The 2023 Decision relied on a number of factors, including that the DPF was overseen by “[t]he FTC [which] is an independent authority composed of five Commissioners … [who] may only be removed by the President for inefficiency, neglect of duty, or malfeasance.”3
In 1935, the U.S. Supreme Court held that the statute restricting the president’s authority to remove Federal Trade Commission (FTC) commissioners was constitutional. See Humphrey’sExecutor v. United States, 295 U.S. 602 (1935). But in Trump v. Slaughter, the Supreme Court overruled Humphrey’s Executor, holding that because the FTC exercises executive power, the president must be able to remove commissioners at his discretion and without constraint from Congress.
European privacy advocates are likely to argue that this abrogates the “independence” of FTC commissioners and thus undermines the 2023 Decision.
US Perspective
From a U.S. law perspective, Trump v. Slaughter changes the structure of federal agencies like the FTC, but it does not change or invalidate the substance of those agencies’ actions. More specifically, the decision changes the relationship between the president and the FTC, but it does not narrow the substantive privacy, cybersecurity or consumer protection laws that the FTC enforces.
The practical U.S. impact is that FTC policy may become more directly tied to presidential priorities, because it allows each new administration to remove agency heads appointed by prior administrations and replace them with appointees who favor the new administration’s views. That could affect enforcement priorities, rulemaking, litigation strategy, remedies, settlement posture and the agency’s willingness to pursue novel theories under their Section 5 authority to police unfair and deceptive data processing practices.
Notably, though the FTC has long been regarded as the nation’s most prominent privacy enforcer, it has never operated under an express mandate to protect personal data. No federal comprehensive privacy law grants the agency direct regulatory authority over data protection; instead, the FTC has relied on its general consumer protection powers to address privacy harms.
Meanwhile, the comprehensive state privacy laws — which do provide substantive data protection frameworks — are enforced by state attorneys general (AGs), and companies should continue to account for state AG enforcement.
State AGs retain independent authority under state consumer protection, privacy, data breach notification and data security laws. If FTC enforcement priorities shift, state AGs may become more active in areas such as privacy, data security, children’s online safety, AI governance, data brokers, dark patterns and sensitive data.
What Happens to the DPF Now?
There are two ways the 2023 Decision could be repealed in response to the decision in Trump v. Slaughter.
First, the European Commission could itself choose to repeal or amend the DPF. The 2023 Decision requires the Commission to “continuously monitor the application of the legal framework … with a view to assessing whether the U.S. continues to ensure an adequate level of protection” and “if necessary … suspend, amend, or repeal” the 2023 Decision.4
But the Commission is unlikely to repeal its 2023 Decision. It has repeatedly designated the U.S. as an “adequate” jurisdiction and sought to encourage international data flows, despite persistent objections from privacy regulators, privacy activists and the European Court of Justice (ECJ). The decision in Trump v. Slaughter is unlikely to change that.
Second, the ECJ could strike down the DPF. The ECJ will have an opportunity to do so soon, when it hears the appeal in Latombe v Commission, a case seeking the annulment of the 2023 Decision. (See our September 5, 2025, client alert “EU Court Upholds EU-US Data Flows in Latombe v Commission.”)
The privacy activist Max Schrems, who successfully convinced the ECJ to strike down both of the DPF’s predecessors, has also announced his intention to lodge a judicial review following Trump v. Slaughter.
On both prior occasions where the ECJ was invited to annul the 2023 Decision’s predecessors, it did so, including on the basis that U.S. oversight bodies were insufficiently independent.5Trump v. Slaughter could be seen as further strengthening the case against the 2023 Decision.
Therefore, there is, at minimum, a reasonable possibility that the ECJ will strike down the 2023 Decision when asked. Companies should proceed on that assumption.
What Companies Should Consider Now
While the decision in Trump v. Slaughter does nothing in the short term to change the DPF, it does increase the risk that pending EU court challenges against the DPF will succeed, and that European privacy activists will launch further court challenges.
Those court challenges are unlikely to be resolved this year, but in the meantime, companies that leverage DPF certification for transfers of personal data from the EU to the U.S. should consider reviewing their fallback plans should the 2023 Decision be struck down. For example, it is common for companies to have SCCs in place in addition to participating in the DPF as a “belts and braces” approach to international transfer compliance.
Companies should also expect further scrutiny from European data protection authorities on international data transfers, and should therefore consider a broader review of their international data transfer compliance, including by refreshing any transfer impact assessments and data maps.
1 Article 45(2)(b) GDPR.
2See Article 1 of European Commission Implementing Decision 2023/1795.
3See Recital 60 to European Commission Implementing Decision 2023/1795.
4See Article 3(1) and 3(5) of European Commission Implementing Decision 2023/1795.
5See, for example, Schrems II at paragraph 188-196.
This memorandum is provided by Skadden, Arps, Slate, Meagher & Flom LLP and its affiliates for educational and informational purposes only and is not intended and should not be construed as legal advice. This memorandum is considered advertising under applicable state laws.
