Privacy & Cybersecurity Law Blog

On July 31, 2026, the European Data Protection Board (“EDPB”) sent a letter to European Commissioner Michael McGrath asking the European Commission to closely examine whether the U.S. Supreme Court’s decision in Trump v. Slaughter could affect the continued validity of the EU-U.S. Data Privacy Framework (“DPF”). The request reflects renewed attention to whether changes in the legal status or practical independence of the U.S. Federal Trade Commission (“FTC”) could have implications for the European Commission’s adequacy decision underlying the framework. Read more about why the ruling has prompted scrutiny of the DPF in our previous blog post.

In the letter, the EDPB emphasized that the existence and effective operation of one or more independent supervisory authorities in a third country is a key factor in assessing whether that country ensures an adequate level of data protection. The letter points to the adequacy decision’s references to the FTC’s institutional independence and to the understanding that FTC commissioners could be removed by the U.S. President only for specified causes, such as inefficiency, neglect of duty, or malfeasance in office.

For organizations, the immediate legal position is unchanged. The DPF remains in effect unless the European Commission amends or withdraws its adequacy decision, or a court invalidates it. Still, the EDPB’s intervention is significant because it formally puts the issue before the European Commission and could lead to a broader review of the framework’s adequacy. As the European Commission considers the EDPB’s request, the key question will be whether Trump v. Slaughter simply alters the legal understanding of agency independence or materially weakens the safeguards underlying the DPF adequacy decision.

Read the EDPB’s letter here. Read our previous blog on the ruling here.