The United States Supreme Court has ruled that the Federal Trade Commission (FTC) is no longer independent, calling into question the foundation of the EU-US Data Protection Framework.

In the case Trump v. Slaughter, the Court ruled that the independence of the FTC was unconstitutional, based on a theory that the US president must control all executive bodies. This decision invalidates a pillar of the European Commission's adequacy decision, which refers 259 times to the independence of the FTC to guarantee "essentially equivalent" data protection as required by Article 8 of the Charter of Fundamental Rights of the European Union and Article 16 of the Treaty on the Functioning of the European Union. The organization noyb has requested the European Commission to formally repeal the agreement, arguing that its legal basis is now obsolete, and has announced its intention to bring the matter before the Court of Justice of the European Union.

Although the adequacy decision remains in effect until repealed by the Commission or annulled by the Court, its implications extend further. Transfers based on Standard Contractual Clauses (SCC) or Binding Corporate Rules (BCR) are also affected, as the underlying impact assessments rely on US bodies, such as the Data Protection Review Court, whose independence is now compromised by the same logic. Affected companies must immediately update their assessments. Only strictly necessary transfers, authorized by Article 49 of the GDPR, are not concerned by this structural challenge.