Supreme Court ends FTC independence in Trump v. Slaughter, nullifying 259 references in EU-US Data Privacy Framework adequacy decision

The decision applies unitary executive theory to declare statutory FTC independence unconstitutional. This directly contradicts the EU requirement under Article 16(2) TFEU and Article 8(3) of the Charter that third-country oversight bodies maintain structural independence equivalent to EU DPAs. The 2023 adequacy decision rested on this premise after CJEU annulments in Schrems I and Schrems II over surveillance and remedy gaps.

Commission Implementing Decision EU 2023/1795 incorporated the FTC as enforcer in 259 separate clauses. noyb documented these references and notified the Commission that the Slaughter holding eliminates the factual predicate for adequacy. Prior frameworks Safe Harbour and Privacy Shield fell on identical independence and redress failures.

Corporations relying on the framework for transatlantic flows now face immediate legal exposure. The Data Protection Review Court, created by executive order, offers no treaty-level fix. The Commission must either suspend the decision or secure unanimous treaty amendment, neither of which has occurred since the July 2024 ruling.

Operational compliance teams are mapping data flows to SCCs and supplemental measures while monitoring enforcement actions from EU DPAs.