The ruling would seem to have little direct link to data transfers across the Atlantic Ocean. Rather, it concerned the independence of American executive branch agencies. In Trump v. Slaughter, the US Supreme Court held that the President may remove Commissioners of the Federal Trade Commission (FTC).
But the long debated, fiercely negotiated EU-US Data Privacy Framework commits Washington to “independent supervision” of European personal data. The European Commission described the FTC as an independent authority whose Commissioners could only be removed for inefficiency, neglect of duty, or malfeasance.
That assumption now becomes hard to sustain. Since the US looks unlikely to legislate European-style privacy rules to defuse the conflict, Brussels needs to reexamine its strategy around international data transfers — or risk yet another conflict with its largest trading partner and investor. Instead of Europe’s present rigid insistence of equivalence with its privacy standards, it should adopt a nuanced, graduated approach that separates the US from authoritarian countries such as China and Russia.
Under the current transatlantic privacy framework, the European Commission must determine next year whether its 2023 green light to American privacy protections remains “factually and legally justified.” Admittedly, data transfers across the Atlantic will not stop tomorrow. A determination that the US no longer measures up will not torpedo the deal, at least immediately. It remains legally in force unless the Commission withdraws or amends it, or the Court of Justice of the European Union annuls it.
Yet privacy lawyers have already begun talking about “Schrems III,” shorthand for a possible third legal challenge to transatlantic data transfers. Austrian privacy activist Max Schrems persuaded the Court of Justice of the European Union to invalidate both 2015 and 2020 data deals, forcing Brussels and Washington to negotiate the present arrangement. After the Supreme Court ruling, Schrems indicated that he is considering a fresh complaint.
Another challenge is already pending. French parliamentarian Philippe Latombe wants to annul the European Commission’s 2023 decision establishing the Data Privacy Framework. Unlike the Schrems cases, which the privacy activist filed with national data protection authorities, Latombe is going directly to Europe’s highest court. He argues that American surveillance powers, oversight mechanisms, and avenues for redress fail to provide protections equivalent to those guaranteed under EU law. His case faces procedural hurdles, including whether he has legal standing.
In addition to concerns over the FTC’s independence, Europeans are watching the fate of Section 702 of the Foreign Intelligence Surveillance Act, the legal basis allowing US intelligence agencies to collect foreigners’ communications. Congress failed to renew the provision before its June 2026 deadline, although surveillance activities may continue until March 2027 under certifications previously approved by the Foreign Intelligence Surveillance Court.
Confronted with these legal challenges, Europeans may need to rethink their approach to digital privacy. Under the bloc’s landmark General Data Protection Regulation (GDPR), personal data is treated as a fundamental right, and that right is expected to travel with the data wherever it goes. Countries are either declared “adequate,” or companies must rely on legal tools such as standard contractual clauses and conduct transfer impact assessments evaluating foreign surveillance laws, oversight mechanisms, and avenues for redress.
International data flows are key to economic infrastructure. Artificial intelligence, cloud computing, digital services, advanced manufacturing, and modern supply chains all depend on the ability to move information across borders with a reasonable degree of certainty. Yet businesses on both sides of the Atlantic today face perpetual uncertainty. European transfers to the US depend on a tenuous political arrangement.
Transfers to countries such as China and Russia face additional hurdles. Companies themselves must determine whether local laws provide protections for European data that are broadly comparable to those available in Europe. If regulators later disagree, transfers can be suspended and companies may face enforcement action.
In practice, businesses are asked to answer questions with obvious geopolitical implications — questions that governments themselves often struggle to resolve. How independent are foreign regulators? How intrusive are a country’s intelligence services? How meaningful is judicial redress?
Although the upcoming review of the transatlantic data deal cannot redesign Europe’s transfer architecture, it should reopen a broad conversation. Europe’s transfer architecture was built on the premise that personal data deserves essentially the same European level of protection regardless of destination. That has produced a binary system: countries are either adequate or they are not.
Yet today’s world is not binary. The US, China, and Russia present different legal, strategic, and economic realities. Europe needs to take a granular, differentiated approach: stable arrangements for trusted jurisdictions, additional safeguards for intermediate-risk countries (perhaps including the US), and strict limits for transfers involving authoritarian jurisdictions with unchecked surveillance.
That would represent a provocative departure from the European privacy regime’s underlying logic. But after two invalidated transatlantic agreements, a third challenge on the way, and a review looming next year, it is fair to ask whether Europe’s architecture regulating data transfers remains practical.
Dr. Anda Bologa is a senior researcher in the Tech Policy Program at the Center for European Policy Analysis (CEPA).
Bandwidth is CEPA’s online journal dedicated to advancing transatlantic cooperation on tech policy. All opinions expressed on Bandwidth are those of the author alone and may not represent those of the institutions they represent or the Center for European Policy Analysis. CEPA maintains a strict intellectual independence policy across all its projects and publications.
Tech 2030
A Roadmap for Europe-US Tech Cooperation
