The last two posts were about data on someone else's infrastructure. The most common reassurance you hear in response, once you say it out loud, goes: "But that's all sorted. There's the Data Privacy Framework." An agreement, an adequacy decision, a tick on the compliance list. Data transfers to the US? Legal. Says so in the Official Journal. Besides, data centres in Frankfurt! Surely that has to be enough by now.
On Monday, 29 June 2026, the US Supreme Court pulled the foundation out from under that reassurance. What looks like American domestic politics, like a power struggle between president and agencies, is a little more than that.
Max Schrems, the man who already brought down Safe Harbor and Privacy Shield before the European Court of Justice, summed it up the same day: Given that there are no independent authorities in the US anymore, we call on the European Commission to orderly withdraw the adequacy decision on the US.
Hm, okay. Come again?
The Monday
The case is called Trump v. Slaughter. Rebecca Slaughter was a Commissioner of the Federal Trade Commission, the US trade regulator. In March 2025 the president dismissed her without any of the grounds set out in law. She sued. The Supreme Court ruled six to three: the dismissal was lawful.
To get there, the Court had to overturn a ruling from 1935, Humphrey's Executor. For ninety years that was the sentence protecting the FTC (and with it around two dozen other agencies, from the securities regulator to the nuclear regulator) from the president's reach: a Commissioner could be removed only on grounds narrowly named in law, neglect of duty or malfeasance, not at political will. That is exactly what made these agencies "independent".
That protection is now gone. The president may fire the people meant to keep him in check whenever it suits him. The finding with which the Court struck down the ninety-year-old protection clause is as plain as it is hard: unconstitutional, unconstitutional.
Ninety years of agency independence, gone. Whatever happened to checks and balances?!
Atlantic bridges and their pillars
Because the entire European data-protection structure for transfers to the US stands on exactly that word: independent.
The European Commission's adequacy decision of 10 July 2023 is the permission to send personal data to certified US firms without setting up extra contracts and assessments every time. It is the legal bridge across the Atlantic. And that bridge stands on two pillars: that an independent authority compels US firms to comply, and that an independent body gives European citizens legal redress when US intelligence agencies scoop up their data. (Anyone still remember Snowden? Shout-out!)
The enforcing authority is the FTC. noyb, Schrems' data-protection organisation, counted it: the adequacy decision relies 259 times on the "independent" FTC. 259 times a word the Supreme Court has just struck out.
The standard by which the European Court of Justice measures such an agreement is called "essential equivalence": the protection over there must be essentially equivalent to the European one. That includes independent oversight and an independent legal remedy. This is EU constitutional law (Article 16 TFEU, Articles 8 and 47 of the Charter of Fundamental Rights). Schrems puts it bluntly: the only way to change this would be for all member states to rewrite the EU treaties unanimously.
An adequacy decision is a legal act resting on an assumption about foreign courts and authorities.
On Monday the Mango in Chief, thanks to the strategically astute appointment of the country's top judges, substantially sharpened his own sword and put the EU, once again, in a decidedly awkward spot vis-à-vis its citizens.
Three hits
Let's make it a little more uncomfortable, shall we? The SCOTUS ruling was not the first blow against the independence of US oversight. It was the third.
First, oversight. The Privacy and Civil Liberties Oversight Board (PCLOB) is the body meant to review the intelligence safeguards the European Commission relied on in 2023. In January 2025 its three Democratic members were dismissed by a one-line email. Since then the board has lacked its quorum. It can no longer decide anything.
Second, redress. The "Data Protection Review Court", the body Europeans are supposed to turn to, is despite its name not a court but an office inside the US Justice Department. Its independence is not written in law but in an Executive Order the president can withdraw with a single signature. And do please recall "Project 2025" here.
Third, enforcement. That was the FTC.
Oversight, redress, enforcement. All three are now either incapacitated or under the president's direct reach. Only the sum produces the finding Schrems invokes: there are no independent authorities left for the agreement to hang on.
The Fed may, the FTC may not
There is a footnote to this Monday that lights up the rest. The same day, the same Supreme Court decided a second case, Trump v. Cook, and did exactly the opposite: the president may not (for now) fire Fed Governor Lisa Cook. Five to four, with a different majority than in the FTC case. The reason: the "distinct historical tradition" of the Federal Reserve's independence.
Read into it what you like. But the selectivity is unmistakable. In one day the Court decided which independence it holds worth protecting and which it does not. Monetary policy: protected. (For now?) The authority European data protection hangs on: sacrificed.
Attempt III
The Data Privacy Framework was, incidentally, already the third attempt at a solution.
Safe Harbor, struck down 2015. Privacy Shield, struck down 2020. Both times the European Court of Justice (on a Schrems complaint) found the same thing: US mass surveillance reaches too far, and European citizens have no effective legal redress against it. Both agreements were declared invalid. With no transition period.
The DPF of 2023 was meant to do better. Critics held it from the start to be the same construction with a new label. Schrems at the time: just claiming that something is "new", "robust" or "effective" does not cut it before the Court.
And the irony: the DPF had just passed its first test. In September 2025 the General Court of the EU dismissed a challenge against it (the one brought by MP Latombe) at first instance; the agreement stood (the appeal against that ruling is still pending before the Court of Justice). Nine months later it was not Luxembourg that tore out the foundation, but Washington. Which, by the way, raises the question of the strategy behind it: were Trump and his lobby simply unaware, or did they just not care? And yet the tech bosses lined up so dutifully at the inauguration.
Schrems III
To put some weight behind it right away, noyb is not asking to "suspend" the agreement, but for an orderly withdrawal of the adequacy decision by the Commission itself. Plus a letter to the Commission and the announcement that in the coming weeks it will go before the European Court of Justice again. Until such a ruling lands, experience says two to three years pass. That would be what people are already calling "Schrems III".
The European Commission is keeping the decision in place for now. An adequacy decision holds until someone lifts it: the Commission itself or the Court. Officially, they are watching the situation. So far nothing has happened.
This is the uncomfortable limbo. Legally, the bridge is still standing. But its foundation was declared unconstitutional on Monday by its own builders.
So here I stand, poor fool …
If the DPF falls, data transfers to the US do not become illegal the next morning. The DPF is only one of several routes. The fallback is called standard contractual clauses (SCCs), supplemented by a case-by-case assessment, the Transfer Impact Assessment, plus technical extra measures such as encryption or EU regions. Microsoft, Google and AWS run these clauses in parallel as a fallback anyway. Whoever has documented it cleanly is not in immediate trouble.
The catch, and it should be named honestly: if the DPF falls, it falls because US law no longer offers equivalent independent control. That very reasoning also undermines the Transfer Impact Assessment. It is hard to write into an assessment that protection is adequate when that very protection has just been struck down by the highest court.
And a grace period is not guaranteed. With Schrems II there was none. Anyone planning today should assume the "effective immediately" scenario, not the "we still have years" one.
None of this can be fixed from here. US administrative law remains a matter for the Americans, and in many places they are busy tightening it so that never again shall any sovereign other than one from the Grand Old Party steer the regime.
"But servers in Frankfurt!" Well, sure.
Sovereignty is more than the question of where the server sits. As we have just seen, what counts far more is: whose signature is enough to change the rule you are relying on.
On Monday a single signature was enough. Whoever builds their critical processes and data on a legal construction that hangs on the independence of foreign authorities has delegated that question to someone else. Whoever builds them on infrastructure they control themselves has at least their own side of it in hand.
What remains
"But there's the Data Privacy Framework." That sentence was never a technical guarantee. It was a reference to a promise: that someone over there is watching independently. The promise was only ever as stable as the institutions carrying it. And since Monday they no longer do.
Familiarity is not a security feature, that held for Outlook. For legal acts something similar applies: a decision in the Official Journal feels like solid ground. A floor tiled with assumptions. For transatlantic data transfers those are, for the third time in ten years, the same assumptions. And for the third time they wobble at the same point.
The Court declared the FTC's independence unconstitutional. The same label now hangs, unspoken, over the bridge built on that independence.
The question is no longer whether the bridge holds. The question is what you have when it falls.