The US just kicked the legs out from under EU-US data transfers

Yesterday, the US Supreme Court ruled, in Trump v. Slaughter (what a name), that the FTC (Federal Trade Commission) was never really independent after all. That means the President can fire its commissioners as he pleases.

You might think “Americans arguing among themselves again, who cares?” Except that the entire legal mechanism that lets your data flow from the EU to the US is bolted to the concept of the FTC being independent. EU law requires independent oversight as the price of adequacy. EU adequacy decisions cite that fact 259 times as the basis for decisions – it’s load bearing.

Now that the load-bearing structure has been removed, the only reason the building is still standing is because no one has pushed on it yet. Max Schrems, the founder of NOYB and the man behind the previous transatlantic agreements getting struck down, already has his shoulder against the wall.

This is the third round in this fight: Safe Harbour died in 2015, Privacy Shield died in 2020. Both from the same root cause: US surveillance law combined with a lack of independent oversight. The current framework was basically the same corpse in a new suit and now NOYB is preparing a fresh court challenge. And Brussels will probably act surprised again.

Nothing legally changes today. The adequacy decision stands until the Commission kills it or Europe's top court does. No Friday deadline. But if you're relying on the fallback paperwork – standard contract clauses or internal corporate rules – rather than adequacy itself, you're not off the hook either. They all leaned on the same now-fictional independence. So, whatever conclusion you reached is now sitting on sand.

What to actually do:

• Don't migrate anything in a panic. This plays out in years, not days.
• Make an inventory of where US-jurisdiction providers sit in your stack, including the sub-processors hiding under a European-flagged SaaS logo.
• Renewing a contract or onboarding something new? Weigh European-owned alternatives now, while you can choose calmly, rather than later when a ruling chooses for you.
• Got a transfer impact assessment on file? Give whoever owns it a heads up.
• Watch how fast (or slowly) the Commission responds. That tells you how much time you actually have

The lesson: stop building infrastructure on top of a promise that can be revoked by a court or a capricious president. "It's always worked out before" is less compliance strategy, and more countdown.

Colin