Implications of Supreme Court Rulings on International Data Transfer

The United States Supreme Court's recent decision in Trump v. Slaughter, while primarily addressing executive powers, has significant implications for international data transfer frameworks, especially between the European Union and the United States. Under the data protection statutes of both the EU and UK, transferring personal information outside the European Economic Area requires stringent safeguards.

Historically, data movement mechanisms between the EU and the U.S. have faced numerous challenges. The initial EU-U.S. 'Safe Harbour' agreement was deemed invalid, and its successor, the 'Privacy Shield', met the same fate with the Court of Justice of the European Union (CJEU) striking it down in 2020. Now, the EU-U.S. Data Privacy Framework (DPF), adopted in 2023, serves as the standard for EU-to-U.S. data transfers, with the UK implementing its 'UK Extension' in October 2023. The DPF's effectiveness is subject to periodic review, with the European Commission last confirming its validity in 2024.

In a separate but related ruling, the Supreme Court challenged the power to remove Federal Trade Commission (FTC) Commissioners, declaring the for-cause removal protection unconstitutional. This decision has raised concerns among EU privacy advocates regarding the FTC's independence, a crucial agency under the DPF framework.

The European Commission is currently evaluating this ruling's impact in collaboration with the European Data Protection Board and national data protection authorities. A Commission spokesperson reaffirmed that the U.S. continues to provide an adequate level of data protection under the DPF, and they are ready to take necessary actions if future developments dictate.

This decision highlights broader concerns about the autonomy of privacy regulators. In the EU, the GDPR requires that data authorities operate independently, a principle firmly supported by German federal law. Meanwhile, the UK is revising its legal framework under the Data (Use and Access) Act 2025, introducing a corporate governance structure that increases government influence over the UK’s data authority.

Despite these rulings, the current data transfer protocols remain intact, upholding the validity of the EU-U.S. DPF and the UK Extension. However, organizations must remain vigilant and stay informed about ongoing regulatory reviews that could impact future data transfer arrangements.