A Letter Brussels Can't Ignore
On July 31, 2026, European Data Protection Board Chair Anu Talus wrote to Michael McGrath, the European Commissioner for Democracy, Justice, the Rule of Law and Consumer Protection, asking the Commission to closely assess whether the US Supreme Court's June 29, 2026 ruling in Trump v. Slaughter undermines the legal basis of the EU-US Data Privacy Framework (DPF). The letter is notably restrained: the EDPB did not call for suspending or revoking the 2023 adequacy decision, only for an evaluation of whether a significant legal development has invalidated assumptions the Commission relied on when it approved the framework. That restraint is itself informative, and worth preserving as the debate escalates.
Why the FTC's Independence Mattered to Adequacy
Under GDPR Article 45(2)(b), a country's data-protection regime counts as "adequate" only if, among other things, an independent supervisory authority exists to enforce the rules. When the Commission adopted Implementing Decision (EU) 2023/1795 on July 10, 2023, it leaned on the FTC's capacity to enforce the DPF's commercial-sector commitments, and on the fact that FTC commissioners could, at the time, be removed by the president only for "inefficiency, neglect of duty, or malfeasance in office" — the same statutory formula the Supreme Court had preserved since Humphrey's Executor v. United States (1935).
Trump v. Slaughter erased that formula. Ruling 6-3, the Court held that FTC commissioners exercise enough executive power, through litigation, rulemaking and adjudication, that the president must be free to remove them at will, overruling Humphrey's Executor outright. The case arose because President Trump fired Commissioner Rebecca Slaughter in March 2025 for reasons he described as "inconsistent" with his administration's priorities — precisely the kind of political cause the old standard existed to exclude. The Court's holding retroactively validated that firing, and the same removal logic now reaches other multi-member federal commissions built on the Humphrey's Executor model.
The Case for Taking This Seriously
The EDPB's concern isn't reflexive. The Commission's 2023 adequacy findings, and the "necessary structures and procedures" it reaffirmed in its October 9, 2024 periodic review, rested partly on that removal shield as evidence the FTC's enforcement posture wasn't simply a function of who occupies the White House. There's already a documented precedent for the worry: in January 2025, Trump fired three Democratic members of the Privacy and Civil Liberties Oversight Board — Travis LeBlanc, Edward Felten and a third commissioner — the body whose annual reporting the Commission also cites when assessing US surveillance safeguards. LeBlanc has said publicly that gutting the board's independence "undermines European confidence" in the framework. If the same removal-at-will theory now covers the FTC, and a future administration used it to install commissioners who simply decline to enforce DPF commitments against politically favored companies, the "independent enforcement" premise the Commission relied on becomes a policy choice of whoever holds the presidency rather than a legal guarantee. That is a fair question for a serious regulator to raise, and dismissing it as reflexive skepticism of American institutions would understate the case.
Why Suspension Would Be the Wrong Answer
But a request for assessment is not a finding, and it shouldn't become one by default. Three things argue against overreaction. First, the Commission already tested a close version of this question: in Latombe v Commission (September 3, 2025), the EU General Court examined whether US oversight — including the Data Protection Review Court created by Executive Order 14086 — was independent enough to satisfy adequacy, and upheld the decision, reasoning that "essentially equivalent" protection doesn't require identical institutional design. The DPRC's redress function, which handles individual EU complaints about US intelligence collection, is structurally distinct from the FTC's commercial-enforcement role that Slaughter actually addressed. The two questions are related, not identical.
Second, European businesses and their US counterparties have already lived through two rounds of exactly this uncertainty: the CJEU struck down Safe Harbor in Schrems I (2015) and Privacy Shield in Schrems II (2020), each time forcing thousands of companies back onto Standard Contractual Clauses that carry the same underlying surveillance exposure without any of the DPF's added redress mechanisms. A third collapse, triggered by a domestic US separation-of-powers ruling rather than a demonstrated failure to protect EU data subjects, would impose enormous compliance cost for a marginal privacy gain: data would keep flowing through other legal routes, just with more friction and less oversight of it.
Third, this dispute is already headed to court regardless of what the Commission does administratively — noyb's Max Schrems has said the group is preparing a fresh CJEU challenge. That is the right venue for resolving a genuinely contested legal question about institutional independence, not a unilateral Commission suspension made under political pressure from a letter whose own author took care not to over-claim.
What Happens Next
The right response is the one the EDPB actually asked for: a transparent, time-bound assessment, ideally folded into the DPF's periodic review cycle rather than a rushed one-off exercise, that asks squarely whether FTC enforcement of DPF commitments has changed in practice, not just in theory. If it hasn't, the framework should stand on its existing footing. If it has, that's a finding the Commission can act on with evidence, rather than inference from a single removal-power ruling three time zones away.