Many US companies spent 2023 and 2024 dismantling the transfer safeguards they had built after Schrems II. Standard contractual clauses, transfer impact assessments and supplementary technical measures were retired, and personal data began flowing to the United States on the strength of a self-certification under the EU-US DPF.1Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 (EU-US DPF adequacy). The framework was designed to end the uncertainty, and for a time it did. On 29 June 2026 the US Supreme Court ruled on the President's power to remove members of the Federal Trade Commission, a question that goes to the premise the framework is built on. The framework has not lapsed, and no European court has struck it down. This article examines whether the premise the framework recites still holds, and what follows for the companies that rely on it.
1. The Foundation the Framework Rests On
An adequacy decision is not a finding that a third country's law is identical to Union law. The test is whether the third country ensures a level of protection essentially equivalent to that guaranteed within the Union, and the Court of Justice made independent oversight of government surveillance a decisive part of that test when it struck down the Privacy Shield in Schrems II.2Case C-311/18 Data Protection Commissioner v Facebook Ireland and Schrems (Schrems II) ECLI:EU:C:2020:559. The DPF was engineered to answer the two deficiencies Schrems II identified: the absence of proportionality limits on US signals-intelligence collection, and the absence of an effective judicial remedy for EU data subjects. That answer came through executive action rather than legislation: Executive Order 14086, which directs US intelligence agencies to observe necessity and proportionality and creates a two-layer redress mechanism culminating in a Data Protection Review Court.3Executive Order 14086 of 7 October 2022 on Enhancing Safeguards for United States Signals Intelligence Activities.
The Commission's adequacy decision leans on three American institutions to supply the independence the test demands. The Federal Trade Commission enforces the framework's commercial-privacy commitments against certified companies. The Privacy and Civil Liberties Oversight Board, a statutory body, reviews how the intelligence agencies apply the Executive Order and reports on the redress mechanism. The Data Protection Review Court reviews the determinations the Civil Liberties Protection Officer of the Office of the Director of National Intelligence makes on individual complaints; its judges must not have been executive-branch employees in the two years before their initial appointment, may hold no other United States Government post while serving, and may be removed only for cause. Each of these was described to the Commission, and accepted by it, as insulated from presidential direction. That insulation is the consideration the Union received in exchange for the free flow of data. The Swiss-US framework rests on the same American institutions: the Federal Council recognized the United States as providing adequate protection for data transferred by certified organizations with effect from 15 September 2024, and Swiss individuals obtain redress through the same Data Protection Review Court.4Swiss-US DPF; US recognized as adequate for certified organizations from 15 September 2024 under the DSG/DSV list of states; EDÖB statement (15 August 2024).
The adequacy decision rests on the independence of three American institutions, and a ruling on presidential removal power can take that independence away without amending a single word of privacy law.
This is why the framework is more fragile than its quiet early run suggested. It rests on an Executive Order that a President can amend or revoke, and on the independence of bodies whose insulation from the President is a matter of US constitutional law rather than of any commitment the United States made to the Union. Nothing in the framework requires Congress to act to weaken it. It can be hollowed out from within the executive branch, and the instruments that would do so are the ordinary instruments of US administrative governance.
2. What the Supreme Court Decided
Trump v. Slaughter concerned the removal of a Federal Trade Commission member, not a data transfer. The Court held, by six votes to three, that the statutory restriction protecting Commissioners from dismissal except for cause is unconstitutional, and that the President may remove them at will. In reaching that result it overruled Humphrey's Executor v. United States, the 1935 decision that had for ninety-one years allowed Congress to shield multi-member expert agencies from at-will removal, leaving standing only a narrow residue for bodies that exercise no part of the executive power.5Trump v. Slaughter, No. 25-332 (US Supreme Court, 29 June 2026, 6-3), overruling Humphrey's Executor v. United States, 295 US 602 (1935). The reasoning is one of separation of powers: a body exercising executive power must answer to the elected executive, and a for-cause shield that prevents the President from controlling it is an unconstitutional intrusion on that power.
The holding names the Federal Trade Commission, but its logic does not stop there. That Commission is the principal authority the DPF relies on to police its commercial-privacy commitments, and a Federal Trade Commission whose members serve at the President's pleasure is no longer the independent enforcer the European Commission was told it was assessing. The reasoning also unsettles the Privacy and Civil Liberties Oversight Board: the administration removed three of its members in 2025 on the view that they too serve at will, a view now contested in the same removal-power terms, and whether an oversight board that exercises no executive power falls within the narrow residue Slaughter left of Humphrey's is itself unresolved. The Data Protection Review Court is vulnerable for a different reason: it was created inside the Department of Justice by executive action, an Attorney General regulation issued under Executive Order 14086, rather than by statute, and executive action can be undone by the executive that took it.
The ruling did not arrive without warning. On 27 January 2025 the administration removed three members of the Privacy and Civil Liberties Oversight Board, dropping it below the quorum it needs to act. A district court ordered two of them reinstated in May 2025, but the D.C. Circuit stayed that order in July 2025 and then held the appeal pending the same removal-power question the Supreme Court had agreed to decide. The board that is supposed to police the Executive Order's proportionality limits and certify the redress mechanism has therefore sat below quorum ever since. It has not gone silent: operating under a sub-quorum policy adopted in October 2024, it published its review of the intelligence agencies' Executive Order policies in September 2025 as a staff report endorsed by its single sitting member rather than as a report voted by a quorate board. The annual public certification that the redress mechanism is processing complaints consistent with the Executive Order has still not issued, on the board's own account because the first qualifying complaint is still being adjudicated.6Three members of the five-member PCLOB removed 27 January 2025 (below quorum); the district-court reinstatement of 21 May 2025 (LeBlanc v. PCLOB) stayed by the D.C. Circuit 1 July 2025; PCLOB staff report 25 September 2025 under its Sub-Quorum Policy; redress-certification statement 13 November 2025. Whether oversight of that character is the independent oversight the adequacy decision recites is a question the decision does not anticipate. Slaughter supplies the constitutional grounding for what the firings had set in motion. Read together, the two events convert the framework's independence guarantees from a settled fact into a contested one, and it is the contest, not any formal repeal, that creates the legal risk.
3. Latombe Upheld a Snapshot
An in-house team that tracked the framework's litigation might reasonably think the question was already settled the other way. In September 2025 the General Court dismissed the first substantive challenge to the DPF. Philippe Latombe, a member of the French National Assembly, had argued that the Data Protection Review Court was not independent and that US bulk collection of data lacked adequate prior safeguards. The Court rejected both arguments: it found the redress court's judges sufficiently protected, and it held that Schrems II does not require prior authorization for bulk collection so long as ex-post judicial review is available.7Case T-553/23 Latombe v Commission (GC, 3 September 2025), dismissing the annulment action; on appeal as Case C-703/25 P (pending). The framework survived, and the survival was widely read as a green light.
The reading is too comfortable, because a judgment reviewing an adequacy decision assesses the decision as it stood when it was adopted. The General Court held that the legality of the decision fell to be assessed on the facts and the law as they stood when the Commission adopted it in July 2023, so that anything post-dating the adoption could not bear on its validity. On that approach the Court could not take account of a board stripped of its quorum in 2025, still less of a Supreme Court ruling handed down in 2026. Latombe upheld the framework only as it stood in July 2023. Nor is the matter closed: Latombe has appealed to the Court of Justice, where the case is pending, and one of his grounds attacks the General Court's treatment of the President's power over the Executive Order's bulk-collection objectives, the very axis of executive control that Slaughter has since sharpened. An appeal confined to points of law and to the 2023 record cannot take the later developments into account, but it keeps the framework's validity in question before the Union's highest court.
The adequacy decision's own conditions matter more than the litigation does. Adequacy is not permanent. The Commission is under a continuing duty to monitor developments in the third country that could affect the functioning of the decision, and where available information reveals that the United States no longer ensures an adequate level of protection it must, to the extent necessary, repeal, amend or suspend the decision, and it need not wait for the periodic review cycle to do so.8Art. 45(3)–(5) GDPR (adequacy, ongoing monitoring, and the duty to amend, suspend or repeal to the extent necessary); the DPF decision contains a corresponding monitoring and suspension mechanism. The first periodic review was completed in October 2024 and concluded that the United States had put the necessary structures and procedures in place. The relevant point is structural: the same instrument that grants the free flow of data reserves the power to withdraw it, and the events of 2025 and 2026 are exactly the kind of development the monitoring duty exists to catch. Privacy campaigners have already pressed the Commission to use that power: noyb wrote to it on 30 June 2026 asking for an orderly repeal of the adequacy decision.
4. Who Kept a Fallback, and Who Did Not
The risk falls unevenly. A company that kept its standard contractual clauses in force and its transfer impact assessment up to date as a fallback beside the DPF can absorb a disruption to the framework by relying on the mechanism it never dismantled. A company that treated certification as a reason to retire that machinery is in a different position. If the adequacy decision is suspended, or an importer's DPF certification is called into question, the transfers it supports do not gracefully revert to a fallback that no longer exists, and a data exporter in the Union that has no alternative mechanism in place is transferring without a valid basis from the moment the framework is disturbed.
Standard contractual clauses do not solve the problem on their own, which is the point Schrems II actually made. The clauses are a valid mechanism only where the exporter has verified, in a transfer impact assessment, that the law and practice of the destination country do not undermine the protection the clauses promise, supplementing them with additional measures where they do.9Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (standard contractual clauses); Schrems II (n 2) on the exporter's assessment duty. A transfer impact assessment for transfers under standard contractual clauses must now deal with the same concerns about US surveillance and the independence of its oversight that Slaughter has revived. A team that reinstates the clauses without revisiting the assessment has rebuilt the form of the fallback without its substance, and the assessment it files today has to grapple with a diminished Federal Trade Commission and an oversight board that has been below quorum since January 2025 and can publish only as staff, rather than reciting the reassurances that were available in 2023.
Swiss flows carry a risk of their own, because the two adequacy determinations do not move in lockstep. Swiss recognition of US adequacy is a separate act of the Federal Council resting on the same American institutions and entered on its own list of states under the DSG, and nothing obliges the Federal Council to revisit that list when the European Commission revisits its decision; the EDÖB supervises transfers but does not decide adequacy. A company serving both EU and Swiss data subjects cannot assume that a Commission decision to suspend or preserve the EU framework carries the Swiss position with it, and a fallback built only for the EU relationship leaves the Swiss flows uncovered. Whether the two relationships can be papered on one track or have to be run as two, and what a fallback would have to contain to cover the Swiss flows as well as the EU ones, are not answered on the face of either determination.
5. Strategic Considerations for Companies Relying on the DPF
The first question is whether a company can afford to be wrong about the framework's survival. If the fallback has been dismantled, is the right response to reinstate standard contractual clauses now, while there is time to do it deliberately, or to wait for a suspension that would force the same work under deadline and with every other importer in the market competing for the same legal and engineering attention? The two costs are not symmetrical, and neither is knowable from the adequacy decision: what a dormant fallback costs to hold depends on the contract estate, and what one costs to rebuild under deadline depends on how many other importers are rebuilding at the same moment.
The assessment itself is the harder artifact. What does a transfer impact assessment honestly say, in the days after the judgment, about the independence of a Federal Trade Commission whose members serve at the President's pleasure, about an oversight board that cannot muster a quorum, and about a redress court that exists at the sufferance of an Executive Order? Whether those facts change the conclusion is a matter of judgment, and whether an assessment that passes over them would survive a supervisory authority's scrutiny is not a question the file can answer about itself, but the file that recites the 2023 position as though nothing has happened is the file that reads worst in hindsight. There is a related question of who inside the organization owns that judgment, and whether it has been escalated to the level at which a decision to keep transferring is actually a decision rather than a default.
Then there is the question of timing that no company controls. Will the Commission act on its monitoring duty before a court is asked to, and is a company better served by a suspension it can plan around or by the uncertainty of waiting to see whether one comes? A suspension would at least be an event with a date; a re-Schrems reference to the Court of Justice would not resolve for years, and in the interval the transfers continue under a cloud rather than a prohibition. The Swiss divergence sits underneath all of it: if the EU framework is suspended and the Swiss one is not, or the reverse, which flows stop and which continue, and does the contract that governs them even distinguish the two? These questions do not resolve on the face of the adequacy decision. They resolve against the specific data flows, the specific importer, and the specific tolerance for operating a transfer whose legal basis is valid today and already contested, which is where the analysis has to begin.