# What Trump v. Slaughter could mean for EU-US data transfers

*The EU-US Data Privacy Framework remains in force, but developers and privacy teams should review transfer records, SCC assessments, and US processor dependencies after Trump v. Slaughter.*

Insights | 2026-07-31T14:30:05.763Z

EU\-US data transfers are under pressure again\. On 29 June 2026, noyb said the US Supreme Court decision in Trump v\. Slaughter undermines a premise of the EU\-US Data Privacy Framework: that the US Federal Trade Commission can act as an independent privacy enforcement authority for certified US companies\.

The decision does not automatically stop EU\-US transfers\. The European Commission's adequacy decision remains in force unless the Commission withdraws, amends, suspends, or the Court of Justice of the European Union annuls it\. But the decision gives privacy teams a reason to review transfer assumptions, especially where records, SCC assessments, or vendor questionnaires rely on independent US oversight\.

This article is legal information for engineering and privacy teams\. It is not legal advice\. Have counsel review your position before changing transfer mechanisms or suspending a production vendor\.

## What you should understand after reading

You should be able to:

- Explain why FTC independence matters to the EU\-US Data Privacy Framework\.
- Separate the immediate operational effect from the legal risk\.
- Identify where DPF, SCC, and BCR assumptions appear in your stack\.
- Start a transfer review without treating every US vendor as the same risk\.

## Why the FTC matters in the EU\-US deal

The EU\-US Data Privacy Framework, adopted in Commission Implementing Decision \(EU\) 2023/1795, lets personal data move from the EU to US companies that self\-certify under the framework\. For commercial privacy commitments, the framework relies heavily on US enforcement bodies, including the FTC\.

Under GDPR Article 45, the European Commission can approve a third country, territory, or sector as adequate only after assessing the level of protection\. That assessment includes effective and enforceable rights, redress, and the existence and functioning of independent supervisory authorities\.

That independence requirement is not a small detail\. Article 8\(3\) of the EU Charter says compliance with data protection rules must be subject to control by an independent authority\. Article 16\(2\) TFEU also refers to control by independent authorities\. The CJEU has treated independent oversight and effective redress as part of the protection expected when personal data leaves the EU\.

noyb's argument is direct: if the US President can remove FTC commissioners, the FTC can no longer be treated as the independent privacy watchdog that the Commission relied on when it adopted the DPF\. noyb also argues that the same reasoning creates problems for the Data Protection Review Court and the Privacy and Civil Liberties Oversight Board, which appear in the surveillance and redress parts of the DPF\.

The Supreme Court decision itself does not decide an EU privacy question\. It addresses US constitutional control over executive agencies\. The EU question is different: whether the US still provides protection that is essentially equivalent to EU law for personal data transferred under the DPF\.

## What changes now, and what does not

The DPF is still formally available today\. A controller transferring personal data to a US organization certified under the DPF can still point to the Commission's adequacy decision while it remains in force\.

That does not make the risk irrelevant\. Adequacy decisions are not permanent\. GDPR Article 45 requires ongoing review, and the Commission can amend, suspend, or repeal an adequacy decision if the third country no longer ensures an adequate level of protection\. The CJEU invalidated the Safe Harbor decision in Schrems I and the Privacy Shield decision in Schrems II\. Both cases turned on the gap between EU fundamental rights standards and US law or remedies\.

For engineering teams, the practical point is narrower than the headline\. Do not assume that all US data flows must stop today\. Do not assume that your old transfer impact assessment is enough either\.

A useful first step is to split transfers into four groups:

1. Transfers relying on the EU\-US Data Privacy Framework\.
2. Transfers relying on Standard Contractual Clauses\.
3. Transfers relying on Binding Corporate Rules\.
4. Transfers that are necessary under GDPR Article 49 derogations, such as a one\-off booking or a contract requested by the data subject\.

Each group has a different legal analysis\. Article 49 is not a general outsourcing strategy\. SCCs and BCRs also do not remove the need to assess the law and practice of the destination country\. The EDPB recommendations on supplementary measures remain the main practical reference for that assessment\.

## What developers should review first

Start with data flow inventory, not legal conclusions\. You need to know what leaves the EU before counsel can decide whether the transfer mechanism still works\.

Prioritize systems that process account data, identifiers, behavioral data, support tickets, logs, analytics events, and message content\. These often reach US processors through SDKs, observability tools, CRM systems, customer support platforms, payment tools, or AI services\.

A simple inventory object can help engineering and privacy teams work from the same list:

```ts
type TransferMechanism =
  | "DPF"
  | "SCC"
  | "BCR"
  | "Article49"
  | "Unknown";

type DataTransfer = {
  service: string;
  vendorEntity: string;
  dataCategories: string[];
  destinationCountries: string[];
  mechanism: TransferMechanism;
  dpfCertified?: boolean;
  lastAssessmentDate?: string;
  businessOwner: string;
  fallbackPlan?: string;
};

const transfers: DataTransfer[] = [
  {
    service: "Product analytics",
    vendorEntity: "Example Analytics Inc.",
    dataCategories: ["user id", "page events", "device metadata"],
    destinationCountries: ["United States"],
    mechanism: "SCC",
    lastAssessmentDate: "2025-08-12",
    businessOwner: "Growth",
    fallbackPlan: "EU-hosted analytics workspace",
  },
  {
    service: "Email delivery",
    vendorEntity: "Example Mail LLC",
    dataCategories: ["email address", "message metadata"],
    destinationCountries: ["United States"],
    mechanism: "DPF",
    dpfCertified: true,
    lastAssessmentDate: "2026-01-30",
    businessOwner: "Platform",
  },
];

const needsReview = transfers.filter((transfer) => {
  const usesUsDestination = transfer.destinationCountries.includes("United States");
  const reliesOnDpf = transfer.mechanism === "DPF";
  const reliesOnAssessment = transfer.mechanism === "SCC" || transfer.mechanism === "BCR";
  const hasOldAssessment = !transfer.lastAssessmentDate || transfer.lastAssessmentDate < "2026-06-29";

  return usesUsDestination && (reliesOnDpf || (reliesOnAssessment && hasOldAssessment));
});

console.table(needsReview);
```

This code does not decide whether a transfer is lawful\. It finds records that need human review\.

## How to update your transfer review

Use a focused review rather than a broad vendor freeze\.

First, confirm the mechanism\. If a vendor relies on DPF, check its current certification on the official Data Privacy Framework list\. If it relies on SCCs, find the signed module and the latest transfer impact assessment\. If the mechanism is unknown, treat it as a documentation issue until the owner fixes it\.

Next, identify the assumption that may have changed\. Some assessments say the risk is acceptable because the FTC, PCLOB, DPRC, or other US bodies provide independent oversight or redress\. Those statements need legal review after Trump v\. Slaughter\.

Then review supplementary measures\. Encryption, EU\-only processing, customer\-managed keys, data minimization, pseudonymization, shorter retention, and strict access controls can reduce risk\. They do not solve every transfer problem\. For example, encryption helps only when the vendor does not need access to the cleartext data for the processing purpose\.

Finally, build an exit path for high\-dependency systems\. That may mean an EU\-region deployment, a different processor, self\-hosting, a feature flag that disables optional data collection, or a data minimization change that removes personal data from a US\-bound event stream\.

## Where consent fits

Consent banners do not fix international transfer risk by themselves\. Cookie and tracking consent can control whether analytics, ads, or personalization scripts run\. Transfer law asks a different question: whether personal data may be sent to a third country under Chapter V of the GDPR\.

The two issues still meet in product code\. If an optional analytics or marketing script sends personal data to a US vendor, consent controls whether the script runs, and the transfer mechanism controls whether the transfer is permitted when it does run\.

For developers, that means optional scripts should be easy to disable by purpose and by region\. A privacy review is much harder when data collection is scattered across inline tags, SDK calls, and server\-side jobs with no owner\.

## What to avoid

Avoid three common mistakes\.

First, do not say your company is "DPF compliant" without checking the exact certification, scope, entity, and role\. The DPF is a transfer mechanism for certified US organizations\. It is not a general GDPR compliance label\.

Second, do not treat SCCs as paperwork only\. After Schrems II, SCCs require a real assessment of whether the recipient can comply in practice, including whether public authority access in the third country undermines the safeguards\.

Third, do not use Article 49 for recurring infrastructure transfers unless counsel has approved that position\. Article 49 derogations are narrow and often fit occasional, necessary transfers better than structural outsourcing\.

## Practical next steps

You can now:

- List EU\-to\-US transfers in your product and operations stack\.
- Separate DPF, SCC, BCR, Article 49, and unknown mechanisms\.
- Flag assessments that rely on independent US oversight or redress\.
- Prepare fallback options for high\-risk or high\-dependency vendors\.

The next review should include legal counsel\. Engineering can make that review faster by producing a clean inventory, removing unnecessary data from US\-bound flows, and making optional trackers easy to switch off\.

Publication note: this topic should receive legal review before publication because the implications of Trump v\. Slaughter for EU adequacy, SCCs, and BCRs are contested and may change quickly\.

## Sources

- noyb: US Supreme Court just blew up EU\-US Data Transfers
- Commission Implementing Decision \(EU\) 2023/1795 on the EU\-US Data Privacy Framework
- US Supreme Court decision in Trump v\. Slaughter
- CJEU judgment in Schrems II, Case C\-311/18
- CJEU judgment in Schrems I, Case C\-362/14
- US Department of Justice: Data Protection Review Court
- US Department of Justice: Executive Order 14086
- EDPB Recommendations 01/2020 on supplementary measures for transfer tools

#GDPR #Compliance