Many US companies spent 2023 and 2024 unwinding the plumbing they had built after Schrems II. Standard contractual clauses, transfer impact assessments and supplementary technical measures were retired, and personal data began flowing to the United States on the strength of a self-certification under the EU-US DPF.1Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 (EU-US DPF adequacy). The framework was designed to end the uncertainty, and for a time it did. On 29 June 2026 the US Supreme Court decided a case that had nothing to do with data protection and everything to do with the premise the framework is built on. The framework has not lapsed, and no European court has struck it down. The question is whether the foundation it recites still stands, and what a company should do about a foundation that has shifted without cracking.
1. The Foundation the Framework Rests On
An adequacy decision is not a finding that a third country's law is identical to Union law. It is a finding that the third country ensures a level of protection essentially equivalent to that guaranteed within the Union, and the Court of Justice made independent oversight of government surveillance a load-bearing part of that test when it struck down the Privacy Shield in Schrems II.2Case C-311/18 Data Protection Commissioner v Facebook Ireland and Schrems (Schrems II) ECLI:EU:C:2020:559. The DPF was engineered to answer the two deficiencies Schrems II identified: the absence of proportionality limits on US signals-intelligence collection, and the absence of an effective judicial remedy for EU data subjects. That answer came through executive action rather than legislation: Executive Order 14086, which directs US intelligence agencies to observe necessity and proportionality and creates a two-layer redress mechanism culminating in a Data Protection Review Court.3Executive Order 14086 of 7 October 2022 on Enhancing Safeguards for United States Signals Intelligence Activities.
The Commission's adequacy decision leans on three American institutions to supply the independence the test demands. The Federal Trade Commission enforces the framework's commercial-privacy commitments against certified companies. The Privacy and Civil Liberties Oversight Board, a statutory body, reviews how the intelligence agencies apply the Executive Order and reports on the redress mechanism. The Data Protection Review Court reviews the determinations the Civil Liberties Protection Officer of the Office of the Director of National Intelligence makes on individual complaints; its judges must not have been executive-branch employees in the two years before their initial appointment, may hold no other United States Government post while serving, and may be removed only for cause. Each of these was described to the Commission, and accepted by it, as insulated from presidential direction. That insulation is the consideration the Union received in exchange for the free flow of data. The Swiss-US framework runs on the same American architecture: the Federal Council recognized the United States as providing adequate protection for data transferred by certified organizations with effect from 15 September 2024, and Swiss individuals obtain redress through the same Data Protection Review Court.4Swiss-US DPF; US recognized as adequate for certified organizations from 15 September 2024 under the DSG/DSV list of states; EDÖB statement (15 August 2024).
The adequacy decision does not buy a set of American statutes. It buys the independence of three American institutions, and independence is precisely the thing a ruling on presidential removal power can take away without amending a single word of privacy law.
This is why the framework is more fragile than its quiet early run suggested. It rests on an Executive Order that a President can amend or revoke, and on the independence of bodies whose insulation from the President is a matter of US constitutional law rather than of any commitment the United States made to the Union. Nothing in the framework requires Congress to act to weaken it. It can be hollowed out from within the executive branch, and the instruments that would do so are the ordinary instruments of US administrative governance.
2. What the Supreme Court Decided
Trump v. Slaughter concerned the removal of a Federal Trade Commission member, not a data transfer. The Court held, by six votes to three, that the statutory restriction protecting Commissioners from dismissal except for cause is unconstitutional, and that the President may remove them at will. In reaching that result it overruled Humphrey's Executor v. United States, the 1935 decision that had for ninety-one years allowed Congress to shield multi-member expert agencies from at-will removal, leaving standing only a narrow residue for bodies that exercise no part of the executive power.5Trump v. Slaughter, No. 25-332 (US Supreme Court, 29 June 2026, 6-3), overruling Humphrey's Executor v. United States, 295 US 602 (1935). The reasoning is one of separation of powers: a body exercising executive power must answer to the elected executive, and a for-cause shield that prevents the President from controlling it is an unconstitutional intrusion on that power.
The holding names the Federal Trade Commission, but its logic does not stop there. That Commission is the principal authority the DPF relies on to police its commercial-privacy commitments, and a Federal Trade Commission whose members serve at the President's pleasure is no longer the independent enforcer the European Commission was told it was assessing. The reasoning also unsettles the Privacy and Civil Liberties Oversight Board: the administration removed its minority members in 2025 on the view that they too serve at will, a view now contested in the same removal-power terms, and whether an oversight board that exercises no executive power falls within the narrow residue Slaughter left of Humphrey's is itself unresolved. The Data Protection Review Court is exposed from a different direction, because it is not a statutory court at all but a body created inside the Department of Justice by executive action, an Attorney General regulation issued under Executive Order 14086, and executive action can be undone by the executive that took it.
The ruling did not arrive without warning. On 27 January 2025 the administration removed the minority members of the Privacy and Civil Liberties Oversight Board, dropping it below the quorum it needs to act; a district court ordered two of them reinstated in May 2025, but the D.C. Circuit stayed that order in July 2025 and then held the appeal pending the same removal-power question the Supreme Court had agreed to decide, so the board that is supposed to police the Executive Order's proportionality limits and certify the redress mechanism has sat below quorum ever since. It has not gone silent: operating under a sub-quorum policy adopted in October 2024, it published its review of the intelligence agencies' Executive Order policies in September 2025 as a staff report endorsed by its single sitting member rather than as a report voted by a quorate board. The annual public certification that the redress mechanism is processing complaints consistent with the Executive Order has still not issued, on the board's own account because the first qualifying complaint is still being adjudicated.6Three of five PCLOB members removed 27 January 2025 (below quorum); the district-court reinstatement of 21 May 2025 (LeBlanc v. PCLOB) stayed by the D.C. Circuit 1 July 2025; PCLOB staff report 25 September 2025 under its Sub-Quorum Policy; redress-certification statement 13 November 2025. Whether oversight of that character is the independent oversight the adequacy decision recites is a question the decision does not anticipate. Slaughter supplies the constitutional grounding for what the firings had set in motion. Read together, the two events convert the framework's independence guarantees from a settled fact into a contested one, and it is the contest, not any formal repeal, that creates the legal risk.
3. Latombe Upheld a Snapshot
An in-house team that tracked the framework's litigation might reasonably think the question was already settled the other way. In September 2025 the General Court dismissed the first substantive challenge to the DPF. Philippe Latombe, a member of the French National Assembly, had argued that the Data Protection Review Court was not independent and that US bulk collection of data lacked adequate prior safeguards. The Court rejected both arguments: it found the redress court's judges sufficiently protected, and it held that Schrems II does not require prior authorization for bulk collection so long as ex-post judicial review is available.7Case T-553/23 Latombe v Commission (GC, 3 September 2025), dismissing the annulment action; on appeal as Case C-703/25 P (pending). The framework survived, and the survival was widely read as a green light.
The reading is too comfortable, because a judgment reviewing an adequacy decision assesses the decision as it stood when it was adopted. The General Court held that the legality of the decision fell to be assessed on the facts and the law as they stood when the Commission adopted it in July 2023, so that anything post-dating the adoption could not bear on its validity. It was not asked, and could not have been asked, about a board stripped of its quorum in 2025 or a Supreme Court ruling handed down in 2026. Latombe validated the architecture as designed; it did not certify the architecture as it now operates. Nor is the matter closed: Latombe has appealed to the Court of Justice, where the case is pending, and one of his grounds attacks the General Court's treatment of the President's power over the Executive Order's bulk-collection objectives, the very axis of executive control that Slaughter has since sharpened. An appeal confined to points of law and to the 2023 record could not itself cure the later developments, but it keeps the framework's validity live before the Union's highest court.
The adequacy decision's own conditions matter more than the litigation does. Adequacy is not permanent. The Commission is under a continuing duty to monitor developments in the third country that could affect the functioning of the decision, and where available information reveals that the United States no longer ensures an adequate level of protection it must, to the extent necessary, repeal, amend or suspend the decision, and it need not wait for the periodic review cycle to do so.8Art. 45(3)–(5) GDPR (adequacy, ongoing monitoring, and the duty to amend, suspend or repeal to the extent necessary); the DPF decision contains a corresponding monitoring and suspension mechanism. The first periodic review was completed in October 2024 and concluded that the United States had put the necessary structures and procedures in place. The relevant point is structural: the same instrument that grants the free flow of data reserves the power to withdraw it, and the events of 2025 and 2026 are exactly the kind of development the monitoring duty exists to catch. Privacy campaigners have already pressed the Commission to use that power: noyb wrote to it on 30 June 2026 asking for an orderly repeal of the adequacy decision.
4. Who Re-Papered, and Who Is Exposed
The exposure is not evenly distributed. A company that treated the DPF as one layer of a redundant architecture, retaining standard contractual clauses and its transfer impact assessment as a live fallback, can absorb a disruption to the framework by leaning on the layer it never dismantled. A company that treated certification as a reason to retire that machinery is in a different position. If the adequacy decision is suspended, or an importer's DPF certification is called into question, the transfers it supports do not gracefully revert to a fallback that no longer exists, and a data exporter in the Union that has no alternative mechanism in place is transferring without a valid basis from the moment the framework is disturbed.
Standard contractual clauses do not solve the problem on their own, which is the point Schrems II actually made. The clauses are a valid mechanism only where the exporter has verified, in a transfer impact assessment, that the law and practice of the destination country do not undermine the protection the clauses promise, supplementing them with additional measures where they do.9Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (standard contractual clauses); Schrems II (n 2) on the exporter's assessment duty. The very US surveillance-independence concerns that Slaughter has revived are the concerns a transfer impact assessment must now confront on the SCC path as well. A team that reinstates the clauses without revisiting the assessment has rebuilt the form of the fallback without its substance, and the assessment it files today has to grapple with a diminished Federal Trade Commission and an oversight board that has been below quorum since January 2025 and can publish only as staff, rather than reciting the reassurances that were available in 2023.
The Swiss layer compounds rather than mirrors the exposure, because the two adequacy determinations do not move in lockstep. Swiss recognition of US adequacy is a separate act of the Federal Council resting on the same American institutions and entered on its own list of states under the DSG, and nothing obliges the Federal Council to revisit that list when the European Commission revisits its decision; the EDÖB supervises transfers but does not decide adequacy. A company serving both EU and Swiss data subjects cannot assume that a Commission decision to suspend or preserve the EU framework carries the Swiss position with it, and a fallback built only for the EU relationship leaves the Swiss flows uncovered. Whether the two relationships can be papered on one track or have to be run as two, and what a fallback would have to contain to cover the Swiss flows as well as the EU ones, is not answered on the face of either determination.
5. Strategic Considerations
The first question is not whether the framework will fall but whether a company can afford to be wrong about it. If the fallback has been dismantled, is the right response to reinstate standard contractual clauses now, while there is time to do it deliberately, or to wait for a suspension that would force the same work under deadline and with every other importer in the market competing for the same legal and engineering attention? The two costs are not symmetrical, and neither is knowable from the adequacy decision: what a dormant fallback costs to hold depends on the contract estate, and what one costs to rebuild under deadline depends on how many other importers are rebuilding at the same moment.
The assessment itself is the harder artifact. What does a transfer impact assessment honestly say, in the days after the judgment, about the independence of a Federal Trade Commission whose members serve at the President's pleasure, about an oversight board that cannot muster a quorum, and about a redress court that exists at the sufferance of an Executive Order? Whether those facts change the conclusion is a matter of judgment, and whether an assessment that passes over them would survive a supervisory authority's scrutiny is not a question the file can answer about itself, but the file that recites the 2023 position as though nothing has happened is the file that reads worst in hindsight. There is a related question of who inside the organization owns that judgment, and whether it has been escalated to the level at which a decision to keep transferring is actually a decision rather than a default.
Then there is the question of timing that no company controls. Will the Commission act on its monitoring duty before a court is asked to, and is a company better served by a suspension it can plan around or by the uncertainty of waiting to see whether one comes? A suspension would at least be an event with a date; a re-Schrems reference to the Court of Justice would not resolve for years, and in the interval the transfers continue under a cloud rather than a prohibition. The Swiss divergence sits underneath all of it: if the EU framework is suspended and the Swiss one is not, or the reverse, which flows stop and which continue, and does the contract that governs them even distinguish the two? These questions do not resolve on the face of the adequacy decision. They resolve against the specific data flows, the specific importer, and the specific tolerance for operating a transfer whose legal basis is sound today and contested tomorrow, which is where the analysis has to begin.