Written by: Haim Ravia, Dotan Hammer
On July 31, 2026, the Chair of the European Data Protection Board (EDPB), Anu Talus, wrote to European Commissioner Michael McGrath asking the Commission to closely assess whether the U.S. Supreme Court’s judgment in Trump v. Slaughter affects the functioning of the adequacy decision underpinning the EU-U.S. Data Privacy Framework, and to share the results of that assessment with the EDPB in a timely manner.
The letter notes that in Trump v. Slaughter the Supreme Court overruled Humphrey’s Executor, holding that the Federal Trade Commission exercises executive power and must therefore be controlled by the President, with the consequence that Commissioners may be removed without the “for cause” restrictions previously understood to apply. The EDPB’s concern is that the Commission’s adequacy decision expressly relied on the independence of the FTC, recording that its five Commissioners could be removed only for “inefficiency, neglect of duty, or malfeasance in office.” The judgment therefore goes to a stated premise of the adequacy finding.
The EDPB frames the issue in terms of Article 45(2)(b) of the GDPR, under which the existence and effective functioning of one or more independent supervisory authorities in the third country is one of the key elements the Commission must take into account when assessing adequacy. The letter does not call for suspension of the Framework and does not address the Privacy and Civil Liberties Oversight Board or the Data Protection Review Court; it is a request for assessment. Organizations relying on the Data Privacy Framework for transfers to the United States should nonetheless treat this as a signal to confirm that fallback transfer mechanisms — standard contractual clauses with supporting transfer impact assessments — remain available and current.
Click here to read the EDPB’s letter to the European Commission.
