A US Supreme Court ruling about the FTC just voided the EU-US data deal

An FTC ruling that never mentioned Europe just voided Europe's data deal

On 29 June 2026 the US Supreme Court decided *Trump v. Slaughter*, holding that the Federal Trade Commission's independence from the President is unconstitutional. The case was about American executive power, not privacy. But Max Schrems' group noyb argues it quietly knocked a leg out from under the EU-US Data Privacy Framework, the 2023 arrangement that lets thousands of US companies legally receive Europeans' personal data.

The link is bureaucratic but decisive. When the European Commission wrote its adequacy decision, it leaned on the FTC as an independent enforcer of US privacy commitments: noyb counts the FTC cited 259 times in that document. EU law is not casual about this. Articles 16(2) TFEU and 8(3) of the Charter require that data protection be policed by a body genuinely independent of the executive. Once the Supreme Court ruled the President controls the FTC, that independence is gone as a matter of US constitutional law, and the European foundation built on it collapses with it.

noyb says the same rot reaches the Data Protection Review Court, the redress body Europeans were told they could complain to. It was never a court in the judicial sense, only an executive tribunal shielded by a Biden executive order, and the unitary-executive logic applies there too. Schrems frames the fix as nearly impossible: "the EU constitutional framework requires independent oversight. The only way to change this would be a unanimous vote by all EU Member States to change the EU treaties." noyb's next steps: a formal letter demanding the Commission repeal the deal in an orderly way, and a lawsuit heading to the Court of Justice.

The thread fills in the history the headline skips

The sharpest context came from a reader who laid out the legal lineage. Schrems' earlier cases killed Safe Harbor and then Privacy Shield, the two predecessors of today's framework, and the pattern was already visible before this ruling.

"in January 2025, Trump fired the Democrat members of the review court, leaving it unable to reach quorum to make decisions, which highlighted it wasn't all that independent. Now it's clearly not independent. I don't see how a Schrems III is not in the works." — a reader who walked through Schrems I and II

One flag went up early about who is actually speaking here. This is an advocacy group's analysis, not a Commission position, a reader cautioned, pointing to the article's own "Commission must repeal" call to action. A Dutch engineer took the mirror-image view of the ruling's irony:

"The US supreme court is correcting the lies the American government made when they assured the EU and its citizens that they can be trusted with their data." — a Dutch engineer in the thread

The recurring worry beneath the legal drama is that adequacy is a paper fix for a plumbing problem. Switching to European vendors is easy on paper; switching to ones that don't quietly use American sub-processors is the hard part.

"Switching to EU companies is easy. Switching to EU companies that don't have American companies as sub-processors is a lot harder." — an engineer at a US FAANG working from Europe

That is why a lawsuit that takes two to three years matters less than it sounds: even a formal repeal leaves European firms wired into AWS, Azure and GCP with no like-for-like replacement. The legal ground has shifted; the infrastructure has not moved an inch.