Supreme Court Ruling on FTC Removal: Implications for EU-US Data Transfers

Source news: "Supreme Court Decision Raises New Questions for EU-US Data Transfers" (Skadden, Arps, Slate, Meagher & Flom LLP) · Search original The following is original commentary written by AI based on facts verified from 3 real news reports (not a translation or copy of the original). See sources at the end.

The U.S. Supreme Court’s recent ruling in Trump v. Slutter, which declares restrictions on the removal of Federal Trade Commission (FTC) commissioners unconstitutional, fundamentally undermines the agency’s perceived independence as a data protection authority. This decision raises immediate compliance concerns for legal teams, as it threatens the validity of the EU Commission’s 2023 adequacy decision, which explicitly relied on the FTC’s status as an independent enforcer to authorize data transfers under the Data Privacy Framework. Consequently, organizations relying on this framework may face renewed uncertainty regarding the legality of transferring personal data from the EU to the US, potentially exposing them to significant regulatory risks and litigation.

Why Now: The Legal Shift in US Data Governance

The U.S. Supreme Court’s June 29, 2026 decision in Trump v. Sloter marks a seismic shift in American administrative law by overturning the 1935 precedent set in Humphrey’s Executor v. United States. In that earlier ruling, the Court had established that the Federal Trade Commission (FTC) was an independent agency whose commissioners could only be removed for cause, thereby shielding them from direct political pressure. The recent ruling declared the statutory provision prohibiting removal without cause unconstitutional, effectively allowing the President to dismiss FTC commissioners at will. This legal reversal fundamentally alters the structural independence of the agency, signaling that FTC policy may now be more closely aligned with the current administration’s priorities rather than operating as a neutral, long-term regulatory body.

This erosion of institutional independence carries significant weight for transatlantic data flows, particularly regarding the European Union’s adequacy decision. The EU Commission’s 2023 determination that the United States provides an adequate level of data protection was explicitly contingent on the FTC functioning as an independent enforcement authority. Because the EU General Data Protection Regulation (GDPR) prohibits data transfers to countries lacking adequate safeguards, any perceived weakening of the FTC’s autonomy threatens the legal foundation of the U.S.-EU Data Privacy Framework (DPF). Privacy advocates in Europe have already argued that the loss of FTC independence undermines the adequacy decision, raising the specter of legal challenges that could invalidate the framework and disrupt the flow of personal data between the two jurisdictions.

Core Issue: The Link Between FTC Independence and EU Adequacy

The European Commission’s 2023 adequacy decision, which permits the transfer of personal data from the EU to the United States, was explicitly predicated on the Federal Trade Commission’s (FTC) status as an independent enforcement body. This independence is a critical pillar of the EU’s assessment, ensuring that US data protection mechanisms operate without undue political interference. However, the US Supreme Court’s recent ruling in Trump v. Sloter fundamentally alters this landscape by declaring the statutory provision prohibiting removal of FTC commissioners without cause unconstitutional. By overturning the precedent set in Humphrey’s Executor v. United States (1935), the Court has removed the legal shield that previously insulated FTC leadership from arbitrary dismissal, thereby jeopardizing the institutional autonomy that Brussels relied upon.

This judicial shift introduces a significant risk that FTC policy may become subject to presidential priority, a development that directly conflicts with the EU’s requirement for an independent supervisory authority. The 2023 adequacy decision applies specifically to companies participating in the Data Privacy Framework (DPF), but its validity hinges on the continued independence of the FTC. If the Commission determines that the FTC’s ability to enforce data protection standards is compromised by the potential for political removal, the foundational justification for the adequacy decision could collapse. EU privacy advocates have already raised concerns that the erosion of the FTC’s independence may provide grounds to challenge the validity of the 2023 decision, potentially destabilizing the legal basis for transatlantic data flows.

Legal Precedent Overturned: The Supreme Court’s decision invalidates the protection against arbitrary removal established in Humphrey’s Executor, signaling that FTC commissioners may be dismissed at the President’s discretion.
EU Adequacy Condition: The European Commission’s 2023 adequacy decision explicitly required the FTC to function as an independent body, a condition now threatened by the new ruling.
Risk of Invalidity: EU privacy advocates argue that the loss of FTC independence could lead to the invalidation of the adequacy decision, which currently allows data transfers only for DPF participants.
Policy Volatility: The ruling suggests that FTC enforcement priorities, including those related to data protection, may become more closely aligned with the current administration’s political agenda rather than consistent regulatory standards.

Practical Impact: Risks to the Data Privacy Framework

The Supreme Court’s ruling in Trump v. Slottter fundamentally alters the legal landscape for transatlantic data flows by undermining the institutional independence that underpins the EU-US Data Privacy Framework (DPF). Because the European Commission’s 2023 adequacy decision applies exclusively to companies participating in the DPF, the framework’s survival is directly tied to the perception that the U.S. Federal Trade Commission (FTC) remains an independent regulatory body. The Court’s decision, which declared the statute prohibiting removal of FTC commissioners without cause unconstitutional, effectively erodes the structural safeguards that previously insulated the agency from political pressure. This shift raises immediate concerns that the EU’s foundational requirement for an independent supervisory authority is no longer met, potentially exposing the entire framework to legal invalidation.

Privacy advocates in the European Union are already arguing that the erosion of the FTC’s independence justifies challenging the adequacy decision. Since the European Commission explicitly considered the FTC’s independent status when granting adequacy in 2023, any demonstrable loss of that independence could trigger lawsuits aimed at nullifying the framework. Such a disruption would leave participating companies without a valid legal mechanism to transfer personal data from the EU to the U.S., creating significant operational risks. The ruling suggests that FTC policies may now be more closely aligned with presidential priorities, further weakening the argument that the agency provides the stable, impartial oversight required under EU law.

Key implications for businesses and legal counsel include:

Legal Vulnerability: The DPF’s adequacy status is at risk of being invalidated by EU courts or regulators due to the loss of FTC independence.
Operational Disruption: Companies relying on the DPF for data transfers may face immediate compliance gaps if the framework is struck down.
Regulatory Shift: The FTC’s limited mandate, combined with increased political influence, may lead to inconsistent enforcement of data protection standards.
Monitoring Necessity: Organizations must closely track legal challenges to the adequacy decision and prepare contingency plans for alternative transfer mechanisms.

Compliance Uncertainty: The FTC's Limited Mandate

The Supreme Court’s decision in Trump v. Sloter fundamentally alters the regulatory landscape for US-based data recipients by exposing the Federal Trade Commission’s structural vulnerabilities. The Court ruled that statutory provisions prohibiting the removal of FTC commissioners without cause are unconstitutional, effectively overturning its own precedent from Humphrey’s Executor (1935). This shift suggests that FTC policy may become more closely aligned with the current administration’s priorities, introducing a layer of political volatility to an agency that already lacks explicit statutory authority for data protection. Instead, the FTC relies on general consumer protection powers to address privacy issues, a framework that critics argue is inherently less robust than dedicated data protection laws.

This legal instability exacerbates concerns among European privacy advocates regarding the validity of the European Commission’s 2023 adequacy decision. That decision, which permits data transfers to companies participating in the US Data Privacy Framework (DPF), explicitly considered the FTC’s role as an independent supervisory authority. With the Court’s ruling undermining the tenure security of FTC commissioners, European stakeholders are increasingly arguing that the agency’s independence has been compromised. This development provides new ammunition for those seeking to challenge the adequacy decision, as the core premise of an independent and stable enforcement mechanism is now legally contested.

For organizations relying on the DPF, the immediate implication is heightened compliance uncertainty. The potential for political pressure on the FTC creates an ambiguous environment where enforcement actions could become unpredictable or subject to shifting political winds. As the EU evaluates whether the US still provides an "adequate" level of protection under the GDPR, the erosion of the FTC’s institutional independence could lead to further legal challenges against the framework. Companies must now monitor not only the stability of the DPF but also the evolving legal interpretations of the FTC’s authority and independence in the wake of this landmark ruling.

Legal Precedent Shift: The Supreme Court’s 2026 ruling in Trump v. Sloter declares restrictions on removing FTC commissioners unconstitutional, reversing the 1935 Humphrey’s Executor decision.
Independence Concerns: The European Commission’s 2023 adequacy decision for the DPF relied on the FTC’s independent status; the new ruling raises doubts about this independence among EU privacy advocates.
Regulatory Ambiguity: Without explicit data protection authority, the FTC’s reliance on general consumer protection powers makes it more susceptible to political influence and policy shifts.
Framework Risk: The potential for an invalidated adequacy decision or increased political pressure on the FTC creates significant compliance risks for US-based data recipients under the DPF.

What to Check: Monitoring Legal Challenges and Framework Stability

Legal teams must closely monitor the potential for lawsuits from EU privacy activists seeking to annul the European Commission’s 2023 adequacy decision, which currently permits data transfers to companies participating in the Data Privacy Framework (DPF). The Supreme Court’s ruling in Trump v. Slutter, decided on June 29, 2026, overturned the precedent set in Humphrey’s Executor (1935) by declaring that statutory protections against the removal of FTC commissioners without cause are unconstitutional. This shift fundamentally alters the perception of the FTC’s independence, a key factor the EU Commission relied upon when granting adequacy status. Activists are likely to argue that this judicial change undermines the structural guarantees of independent oversight, thereby threatening the legal basis for cross-border data flows under the DPF.

The stability of the DPF is now inextricably linked to the FTC’s evolving mandate and perceived autonomy. Because the FTC lacks explicit authority for privacy protection and operates through general consumer protection powers, its ability to enforce the DPF without political interference is critical. The Supreme Court’s decision suggests that FTC policy may become more closely aligned with presidential priorities, raising doubts about whether the agency can maintain the impartial regulatory environment required by the GDPR. Organizations relying on the DPF must assess whether this new judicial landscape exposes them to renewed legal risks and whether their current compliance frameworks remain secure against potential invalidation by EU courts.

Legal Vulnerability: EU privacy groups may file challenges to invalidate the 2023 adequacy decision, citing the loss of FTC independence as a failure to meet GDPR standards.
Framework Risk: The Data Privacy Framework’s validity depends on the FTC’s ability to act as an independent enforcer, a role now compromised by the Trump v. Slutter ruling.
Compliance Monitoring: Companies must track ongoing litigation and regulatory shifts to determine if alternative transfer mechanisms are needed if the adequacy decision is overturned.
Judicial Precedent: The overturning of the 1935 Humphrey’s Executor precedent marks a significant shift in US administrative law, with direct implications for international data governance.

Frequently Asked Questions

How does the Supreme Court's ruling on FTC removal affect the EU-US data transfer adequacy decision?

The European Commission's 2023 adequacy decision relied on the FTC functioning as an independent supervisory authority. If the Supreme Court's ruling undermines this independence, EU privacy advocates argue it could lead to the invalidation of the adequacy decision.

What is the significance of the Supreme Court overturning the Humphrey’s Executor precedent?

The 1935 Humphrey’s Executor case previously established that restrictions on removing FTC commissioners were constitutional. The recent ruling declared such for-cause removal protections unconstitutional, signaling that FTC policy may become more closely aligned with presidential priorities.

Does the FTC have explicit authority to enforce US data privacy laws?

The FTC does not possess explicit statutory authority for data privacy protection. Instead, it addresses data protection issues through its general consumer protection powers, which complicates its role as a recognized independent regulator under EU standards.