Why Donald Trump’s Increase in Power Puts Transatlantic Data Transfer into Question Again

On June 30, 2026, the United States Supreme Court made a decision in the case of Trump v. Slaughter that could extend far beyond American domestic politics. The court strengthened the powers of the US President over independent federal agencies, ruling that statutory restrictions on his dismissal powers are unconstitutional in certain cases.

The case was triggered by President Donald Trump’s dismissal of the two Democratic members of the Federal Trade Commission (FTC), Rebecca Slaughter and Alvaro Bedoya, at the start of his second term. Under existing law, FTC members could generally only be dismissed for important reasons—such as misconduct or gross dereliction of duty. However, Trump justified the dismissals solely on political differences and his administration’s priorities.

Several lower courts initially declared these dismissals unlawful. The Supreme Court has now overturned these decisions, departing from nearly a century-old precedent that aimed to protect independent federal agencies from direct political influence. While the Federal Trade Commission remains and retains its duties, its institutional independence from the White House is significantly weakened by the ruling.

At first glance, this decision seems like a purely American constitutional issue. However, it could have significant implications for data protection and transatlantic data transfer.

Why the FTC is So Important for Europe

The General Data Protection Regulation (GDPR) allows the transfer of personal data to countries outside the European Union only under certain conditions. The most important of these is that the third country in question maintains a level of data protection that is “essentially equivalent” to European protection.

Since July 2023, the EU-US Data Privacy Framework has formed the legal basis for these data transfers to the United States. With this adequacy decision, the European Commission determined that certified US companies are generally allowed to process personal data from Europe lawfully.

However, this decision is not based solely on the promises of the companies themselves. Crucially, it relied on the assessment of American control and oversight mechanisms. The Federal Trade Commission plays a central role in this.

The importance of the agency becomes particularly clear when looking at the adequacy decision: The European Commission refers to the FTC and its role as an independent supervisory and enforcement authority a total of 259 times. This frequency shows that the assumed independence of the FTC is not a minor aspect but a fundamental pillar of the entire legal assessment.

Why the Ruling Puts the Data Privacy Framework into Question

This is precisely where the legal problem now arises.

The European Commission’s assessment assumed that the FTC acts independently of political directives and objectively pursues violations by American companies. The Supreme Court’s ruling at least partially undermines this assumption.

If the President can exert significantly greater influence over the agency’s leadership in the future, the question inevitably arises whether the FTC can still be regarded as an independent supervisory authority. However, this independence was a key component of the argument with which the European Commission adopted the Data Privacy Framework.

This does not automatically mean that the adequacy decision has become invalid. The ruling does not overturn the Data Privacy Framework. However, it changes the actual conditions on which the European Commission’s decision is based. Legally, this creates a significant need for review.

Max Schrems and noyb See Need for Action

This assessment is now also shared by data protection organizations.

Max Schrems and his organization noyb have already called on the European Commission to revoke the Data Privacy Framework. Their argument is understandable: If a key prerequisite of the adequacy decision—namely the independent oversight by the FTC—no longer exists, then the European assessment must also be reviewed.

Whether this view will ultimately hold is currently open. The European Commission has not yet withdrawn the Data Privacy Framework. Parallel proceedings before the European Court of Justice are already dealing with the legality of the agreement.

Do Companies Need to Act Now?

Currently, there is no immediate need for action.

The Data Privacy Framework remains in effect. Companies can still rely on the existing adequacy decision. Short-term sanctions are also not expected at present.

Nevertheless, companies should closely monitor developments. In the past, both Safe Harbor and later Privacy Shield—two comparable agreements—were declared invalid by the European Court of Justice. Both were previously considered viable foundations for transatlantic data transfer for years.

The current ruling does not necessarily mean that this history will repeat itself. However, it once again highlights how dependent European companies are on political and legal developments beyond their control.

Even companies using alternative transfer instruments such as Standard Contractual Clauses (SCCs) or Binding Corporate Rules (BCRs) should review their data protection impact assessments and transfer impact assessments. These instruments also require that the actual legal framework conditions in the recipient country are realistically assessed.

Digital Sovereignty Becomes a Question of Risk Management

The current development shows that digital sovereignty is no longer just a political buzzword.

Those who build their entire digital infrastructure on non-European cloud providers inevitably also assume the legal and political risks of these countries. These risks cannot be completely excluded, either contractually or technically.

Therefore, the evaluation of European cloud and software providers is also changing. In addition to price, functionality, or scalability, another factor is gaining importance: the long-term legal stability of the chosen infrastructure.

Companies will have to increasingly consider whether their digital core systems are dependent on regulatory developments in third countries or can be operated within a European legal framework.

Why Companies Should Strategically Plan Now

Regardless of how the Data Privacy Framework is ultimately assessed, the ruling shows one thing above all: Legal frameworks can change quickly and have significant impacts on long-term digital strategies.

This is precisely why an independent evaluation of one’s own IT landscape is becoming increasingly important. Companies should analyze early on what dependencies exist on individual hyperscalers or non-European services, what regulatory risks are associated with them, and what alternatives are available for critical systems.

This is where ayedo comes in. We support companies in setting up their IT strategy for long-term resilience, recognizing regulatory risks early, and examining the use of European and sovereign cloud and open-source solutions where they are economically and technically sensible. The goal is not an ideologically motivated departure from US providers but a well-founded strategic decision based on legal certainty, risk management, and sustainable future viability.

The Supreme Court’s ruling impressively demonstrates that digital infrastructure today is no longer solely a technical decision. It has long since become a legal and strategic question.