European Commission urged to withdraw US adequacy after Supreme Court decision

What happened

• The Supreme Court’s ruling in Trump v. Slaughter found the FTC cannot serve as an independent regulator for EU‑US data transfers.
• EU law requires an independent authority to oversee personal data protection in third countries.
• The European Commission has relied on the FTC 259 times in its adequacy assessment for the EU‑US Data Privacy Framework.
• Privacy groups, led by Max Schrems, are demanding the Commission withdraw the adequacy decision.

Why it matters

Companies that rely on the EU‑US Data Privacy Framework must prepare for possible suspension of data flows and evaluate alternative legal bases such as Standard Contractual Clauses or local storage.

Business impact

Loss of the adequacy decision could force firms to renegotiate contracts, implement additional safeguards, or shift workloads to EU‑based cloud providers, increasing compliance costs and operational complexity.

What to check

1. 1

   review data transfer mechanismsHigh priority

   Assess whether current transfers rely on the EU‑US Data Privacy Framework and identify fallback options like SCCs or BCRs.

2. 2

   update privacy noticesMedium priority

   Inform data subjects of any changes to the legal basis for cross‑border transfers.