Trump v Slaughter: What the US Supreme Court’s ruling means for transatlantic data flows

While the case is fundamentally about the separation of powers in the US, it has prompted significant commentary about its potential implications for transatlantic data flows. Here is our balanced overview.

Background: transatlantic transfers of personal data

Under both the EU and UK data protection frameworks, transfers of personal data to countries outside the European Economic Area or the UK require adequate safeguards to be put in place.

The mechanisms enabling transatlantic data flows to the US have a turbulent history. The EU-US ‘Safe Harbour’ framework was invalidated by the Court of Justice of the European Union in Schrems I (2015), and its successor, the EU-US ‘Privacy Shield’, met the same fate in Schrems II (2020).

The current EU-US Data Privacy Framework (DPF), adopted in 2023, provides the latest adequacy basis for EU-to-US data transfers. The UK’s own arrangement, the ‘UK Extension’ to the EU-US DPF, became operational on 12 October 2023. The DPF is subject to periodic review - the European Commission upheld its validity following the first review in October 2024. The Commission’s second review is due to take place next year.

Organisations can also rely on other transfer mechanisms, such as the EU Standard Contractual Clauses or Binding Corporate Rules for intra-group transfers, or the UK equivalents of these.

The decision in Trump v Slaughter

The Supreme Court’s ruling centres on executive power, specifically whether Congress can insulate FTC Commissioners from presidential removal. The Court held that the FTC’s for-cause removal provision violates the separation of powers under the US Constitution. The FTC plays a key enforcement role under the DPF: only US businesses regulated by the FTC or the US Department of Transportation are eligible to self-certify under the framework.

EU privacy campaigners have suggested that the ruling could undermine the independence of the FTC and, by extension, the robustness of the DPF as assessed by the European Commission. Any legal challenge to the validity of the DPF would ultimately need to be determined by the Court of Justice of the European Union (CJEU), most likely by way of a preliminary reference from a national court, a process that has historically taken several years.

European Commission’s response

We understand that the European Commission is in discussion with the European Data Protection Board and European data protection authorities, evaluating the impacts of the decision.

Following the ruling, the European Commission was asked directly whether it would withdraw the adequacy decision in light of the judgment. A Commission spokesperson confirmed that the Commission’s adequacy decision of July 2023 concluded that the US provides an adequate level of protection under the DPF, and that the Commission monitors all adequacy decisions on an ongoing basis. Importantly, the spokesperson noted that the main instrument under US law on which the framework is based, the US executive order, “continues to be in place and continues to provide key safeguards to data transferred from the EU.” When pressed on what options exist if the adequacy decision were found to be no longer adequate, the spokesperson reminded the press that, under the GDPR, the Commission has “all the necessary tools in place to react to possible developments.”

Regulatory independence: comparative perspectives

The Slaughter ruling raises a broader question about what ‘independence’ means for privacy regulators. Under Article 52 of the EU General Data Protection Regulation (GDPR), each supervisory authority must act with ‘complete independence’ in performing its tasks and exercising its powers.

By way of comparison, in Germany, the Federal Commissioner for Data Protection and Freedom of Information operates independently under federal law, reflecting the GDPR’s requirements. The German Federal Constitutional Court has historically upheld the principle of data protection authority independence.

In the UK, the Commissioner can only be removed from office by the Crown on an Address from both Houses of Parliament, and only where a Minister has certified that grounds of serious misconduct or inability to perform functions are made out. However, the position is evolving. The Data (Use and Access) Act 2025 (DUAA) replaces the individual office of the Information Commissioner with a new corporate body, the Information Commission. The DUAA also gives the Secretary of State a new general power, via secondary legislation, to require the regulator to prepare codes of practice on specified topics. The Information Commissioner was already required to prepare codes on certain subjects (such as data sharing and age-appropriate design) under sections, and the Secretary of State already had a role in laying those codes before Parliament. The novelty lies in the open-ended nature of the new power, which is not confined to a fixed statutory list.

Practical steps

Importantly, the Slaughter ruling does not, in and of itself, result in any immediate changes to existing data transfer mechanisms.

The EU-US DPF and the UK Extension remain valid. However, organisations should consider:

• Taking the opportunity to review the transfer safeguards currently in place for transatlantic personal data flows.
• Revisiting any transfer impact assessments (TIA) that rely on the independence of US review bodies such as the FTC. If a TIA specifically relied on the independence of these bodies, or if it incorporated a specific definition of independence, it may need updating.
• Monitoring developments, including any formal challenge to the DPF before the CJEU.

This is a noteworthy development and one worth watching closely, but it is not a cause for immediate alarm.