Trump v. Sloter: How SCOTUS Ruling Threatens EU-US Data Transfer Stability

Source news: "Supreme Court Decision Raises New Questions for EU-US Data Transfers" (Skadden, Arps, Slate, Meagher & Flom LLP) · Search original The following is original commentary written by AI based on facts verified from 3 real news reports (not a translation or copy of the original). See sources at the end.

The Supreme Court’s decision in Trump v. Sloter overturns Humphrey’s Executor, ruling that the FTC Chair serves at the pleasure of the President and can be removed without cause. This ruling fundamentally undermines the basis of the European Commission’s 2023 adequacy decision, which relied on the FTC’s status as an independent enforcement authority. Consequently, US-based companies participating in the EU-US Data Privacy Framework now face renewed legal instability, as European privacy advocates may argue that the loss of FTC independence invalidates the framework’s core safeguards.

Why Now: The SCOTUS Shockwave

On June 29, 2026, the U.S. Supreme Court issued a landmark ruling in Trump v. Sloter that fundamentally reshapes American administrative law by affirming the president’s power to remove Federal Trade Commission (FTC) commissioners without cause. In a decision that explicitly overturns the 1935 precedent set in Humphrey’s Executor, the Court held that because the FTC exercises executive power, its commissioners are not shielded from arbitrary dismissal by statutory protections. The justices determined that existing laws limiting removal to instances of inefficiency, neglect of duty, or corruption were unconstitutional, thereby stripping the agency of the independent status it has long claimed. This shift places the FTC directly under presidential control, removing the legal barriers that previously insulated the commission from political interference.

The immediate consequence of this ruling is the potential destabilization of the European Union’s 2023 adequacy decision, which permits the free flow of personal data from the EU to U.S. companies participating in the Data Privacy Framework (DPF). The European Commission’s original determination was heavily predicated on the FTC’s role as an independent regulatory body capable of enforcing privacy commitments. With the Supreme Court’s decision eroding the FTC’s structural independence, European privacy advocates argue that the foundational justification for the adequacy ruling is now void. If the FTC can no longer be considered an independent enforcer, the legal basis for allowing EU data to transfer to the United States under the current framework is severely compromised, creating immediate uncertainty for transatlantic data flows.

Core Issue: Overturning Precedent and Independence

In the Trump v. Sloter decision issued on June 29, 2026, the U.S. Supreme Court explicitly overturned the 1935 Humphrey’s Executor precedent, marking a seismic shift in administrative law. The Court ruled that statutory protections shielding Federal Trade Commission (FTC) commissioners from removal without cause are unconstitutional, affirming broad presidential removal power. By declaring that the FTC exercises executive power, the justices determined that the President may remove the Commission’s chair at will, without the constraints previously imposed by Congress. This ruling dismantles the legal framework that had long protected independent regulatory agencies from direct political interference, fundamentally altering the balance of power between the executive branch and federal regulators.

The practical consequence of this ruling is that the legal foundation for the European Commission’s 2023 adequacy decision is now critically compromised. The EU’s determination that the United States provides an adequate level of data protection was heavily contingent on the FTC’s status as an independent supervisory authority. Under the previous legal regime, the FTC Chair could only be removed for inefficiency, neglect of duty, or corruption, ensuring a degree of insulation from political pressure. With the Supreme Court’s new interpretation, that statutory guarantee has been nullified, leaving the FTC’s independence vulnerable to arbitrary presidential action. Privacy advocates argue that this erosion of institutional autonomy undermines the core premise of the adequacy finding, potentially rendering the 2023 decision legally voidable.

Overturned Precedent: The 1935 Humphrey’s Executor decision, which limited presidential removal power over independent agency heads, was explicitly rejected by the Court.
Executive Power Expanded: The Court classified the FTC as an executive agency, allowing the President to remove the Chair without cause or statutory restriction.
Adequacy Decision Threatened: The EU’s 2023 adequacy ruling relied on the FTC’s independence; the loss of statutory removal protections destabilizes this foundation.
Regulatory Vulnerability: Without explicit federal privacy laws, the FTC’s existing consumer protection authority is now subject to greater political volatility, raising concerns among EU privacy advocates.

Practical Impact: EU Adequacy at Risk

The European Commission’s 2023 adequacy decision, which validates the EU-US Data Privacy Framework (DPF), explicitly hinges on the Federal Trade Commission’s (FTC) status as an independent supervisory authority. This legal framework assumes that the FTC can enforce privacy protections without undue political interference. However, the Supreme Court’s ruling in Trump v. Sloter fundamentally undermines this assumption by declaring that statutory protections against removal for cause are unconstitutional. By overturning the precedent set in Humphrey’s Executor (1935), the Court established that the FTC exercises executive power, thereby allowing the President to remove commissioners at will. This shift suggests that the FTC’s ability to act as a neutral arbiter in data privacy matters is no longer guaranteed by law, creating a critical vulnerability in the foundation of the adequacy decision.

As a result, the validity of the 2023 adequacy decision is now exposed to immediate legal challenges. European privacy advocates are likely to argue that the erosion of the FTC’s independence renders the decision invalid, as the core requirement of an effective and independent enforcement mechanism is no longer met. Because the adequacy decision applies specifically to companies participating in the DPF, any loss of confidence in the FTC’s autonomy could destabilize the entire framework. Without the safeguard of "for cause" removal protections, the FTC’s enforcement actions could be perceived as politically motivated, potentially leading to the invalidation of the adequacy decision and leaving EU-US data transfers in a legal limbo.

Legal Precedent Overturned: The Supreme Court’s decision in Trump v. Sloter reverses the 1935 Humphrey’s Executor ruling, removing constitutional barriers to the President’s power to dismiss FTC commissioners.
Independence Compromised: The 2023 adequacy decision relied on the FTC’s ability to enforce privacy laws independently; the new ruling allows for at-will removal, threatening this independence.
Adequacy Decision Vulnerable: The European Commission’s 2023 decision, which permits data transfers under the DPF, may face successful legal challenges from privacy advocates citing the loss of FTC independence.
Framework Instability: Since the adequacy decision applies only to DPF participants, its potential invalidation could disrupt the legal basis for transatlantic data flows for these specific entities.

What to Check: Compliance and Governance

The Supreme Court’s decision in Trump v. Sloter fundamentally destabilizes the legal foundation of the EU-US Data Privacy Framework (DPF) by invalidating the independence of the Federal Trade Commission (FTC). By overturning the 1935 Humphrey’s Executor precedent, the Court ruled that FTC commissioners are executive officers who can be removed by the President at will, rather than holding the statutory protection for "cause" required by the 2023 adequacy decision. This shift means the FTC, which currently serves as the independent supervisory authority underpinning the DPF, may no longer meet the EU’s requirement for an autonomous enforcement body. Consequently, the entire framework’s validity is now contingent on a regulatory structure that the highest US court has declared vulnerable to political removal.

US companies participating in the DPF must urgently assess their reliance on this framework and prepare for potential regulatory shifts or litigation regarding the FTC's authority. Since the FTC lacks explicit comprehensive privacy legislation and relies on consumer protection powers, its ability to enforce privacy commitments is now legally precarious. Organizations should monitor for immediate challenges from European privacy advocates who may argue that the erosion of the FTC’s independence nullifies the 2023 adequacy decision. Proactive governance measures are essential, as the loss of the FTC’s protected status could expose companies to sudden enforcement gaps or the need to pivot to alternative transfer mechanisms like Standard Contractual Clauses.

Key compliance risks include:

Loss of Independent Oversight: The FTC’s new status as an at-will executive officer may violate the independence criteria embedded in the EU’s 2023 adequacy decision.
Framework Validity: The DPF’s legal basis is directly threatened, potentially rendering current transfers non-compliant with EU data protection laws.
Enforcement Uncertainty: Without statutory "cause" protection, the FTC’s enforcement consistency and authority over privacy commitments are in question.
Strategic Preparedness: Companies must evaluate contingency plans, including the potential need to adopt alternative data transfer mechanisms if the DPF is invalidated.

Frequently Asked Questions

What are the potential consequences for companies relying on the EU-US data transfer framework?

European privacy advocates may argue that the loss of FTC independence renders the 2023 adequacy decision ineffective, potentially disrupting data flows. Companies participating in the Data Privacy Framework face increased legal risk as the regulatory environment in the US becomes less predictable.