Trump v. Slaughter: The US Constitutional Court Ruling – How a US ruling is bringing down Europe's data privacy house of cards

Billions in risk of data transfer: Why data exchange with the USA could now become illegal

Data earthquake for European companies: Supreme Court destroys the EU-US Data Privacy Framework

On June 29, 2026, the US Supreme Court delivered a ruling in Trump v. Slaughter that was ostensibly intended to resolve a domestic political question in Washington concerning the balance of power between the president and independent agencies. The consequences for Europe were more spectacular than any planned attack on the transatlantic data protection regime: With a 6-3 decision along conservative-liberal lines, the court declared the independence of the Federal Trade Commission (FTC) unconstitutional—and in doing so, pulverized the foundations of the entire EU-US Data Privacy Framework (DPF). What followed was no surprise to those in the know, but a shock to those who had for years acted as if the house of cards were built of concrete.

Related to this:

• Supreme Court upheaval – Alternatives NOW: Why cloud usage from Microsoft, AWS & Google is suddenly on the brink

When Washington remains Washington – and Brussels looked away for too long

The architecture of a sham peace: What the DPF was — and what it could never be

To understand the implications of the ruling, one must know the history of this transatlantic data pact — and it is a history of permanent improvisation under industrial pressure.

Since 2000, the European Commission has repeatedly attempted to certify the US as having an "adequate level of data protection," which, according to the GDPR, is a prerequisite for the free flow of data to third countries. The first attempt, the so-called Safe Harbor agreement, failed in 2015 at the European Court of Justice (ECJ) – Max Schrems had successfully demonstrated that US intelligence agencies systematically accessed European data without EU citizens having effective legal recourse. The successor agreement, Privacy Shield, was struck down in 2020 by the Schrems II ruling: The ECJ again found that FISA Section 702 and Executive Order 12333 granted US intelligence agencies virtually unlimited access to the data of non-US citizens, while European citizens had no effective legal protection whatsoever.

Instead of drawing the obvious conclusion from these defeats—namely, to implement a fundamental change to US surveillance law—the Commission, under massive lobbying pressure from industry, opted for a third attempt. In October 2022, the Biden administration enacted new mechanisms to protect European data via Executive Order 14086. This included the so-called Data Protection Review Court (DPRC), a quasi-judicial body within the US Department of Justice, which was intended to grant European citizens the right to appeal against US intelligence access. Based on this, the European Commission adopted the adequacy decision for the EU-US Data Privacy Framework in July 2023.

The data protection organization NOYB pointed out from the outset that the new agreement was essentially a copy of its two previous, already failed, predecessors. These arguments were ignored. Businesses breathed a sigh of relief—and tens of thousands of European companies based their data processing operations on a legal foundation that rested on a single presidential decree issued by the current president's predecessor. A decree that Donald Trump could revoke at any time.

The FTC as a sandcastle: The systemic design flaw in the DPF

The legal core of the DPF was always the claim that the US offered a "substantially equivalent" level of data protection—and this equivalence required an independent supervisory authority. EU treaty law is exceptionally clear on this point: Article 16(2) TFEU and Article 8(3) of the EU Charter of Fundamental Rights mandate that data protection oversight be carried out by an independent body. For the US, this role was assumed by the FTC.

What NOYB demonstrated with chilling precision following the Supreme Court ruling was this: In its 2023 adequacy decision, the European Commission relied 259 times on the independence of the FTC as a cornerstone of the agreement. 259 times. The entire architecture of the agreement was built around an agency whose independence the US Supreme Court has now declared unconstitutional.

The ruling in Trump v. Slaughter followed the so-called "Unitary Executive Theory," according to which the US president must have complete control over all branches of the executive branch. Chief Justice John Roberts stated it directly in the reasoning of the judgment: "The president may dismiss his subordinates at his discretion. The FTC undoubtedly exercises executive power and must therefore be controlled by the head of state." With this reasoning, the court overturned the 91-year-old precedent Humphrey's Executor v. United States from 1935, which had established precisely this limitation on the president's power to dismiss independent regulatory agencies.

For the EU-US DPF, this means that the FTC, the central pillar of the entire agreement, mentioned 259 times in the treaty, is now completely subservient to the White House. It is no longer an independent regulatory body in the European sense—and, according to the US Constitutional interpretation, may never have truly been. Max Schrems put it succinctly: “The crucial point is that the EU's constitutional framework mandates independent oversight. The only way to change this would be a unanimous decision by all EU member states to amend the EU treaties.”

Humphrey's Executor and 91 Years of Administrative Statecraft

To fully grasp the legal dimension, it's worth taking a brief look at what the Supreme Court ruling actually eliminated. Humphrey's Executor v. United States, from 1935, laid the foundation for the entire system of independent regulatory agencies in the United States—from the FTC to the Federal Communications Commission (FCC) to the Securities and Exchange Commission (SEC). The ruling clarified that Congress could limit the president's power to dismiss officials from agencies that exercise quasi-legislative or quasi-judicial functions without violating the Constitution.

The ruling of June 29, 2026, overturns this nine-decade-old foundation. The conservative 6-3 majority sees it as restoring constitutional order, since executive power, according to the Constitution, rests entirely with the president. The three liberal justices, Sonia Sotomayor, Ketanji Brown Jackson, and Elena Kagan, warned in their joint dissent opinion that this ruling undermines the institutional independence of all regulatory agencies and thus represents an unprecedented increase in executive power.

Legal experts like data protection lawyer Ilia Kolochenko of ImmuniWeb described the ruling as a potential “point of no return” for transatlantic data transfers: “The ruling will have no immediate impact on EU-US data flows in the short term, but its long-term consequences could be significant. It gives data protection activists like NOYB and Max Schrems a strong new argument that US data transfers are now illegal.”

The history of data exchange in three acts — and the finale

The history of transatlantic data protection can be read as a drama in four acts, three of which have already been written:

The first act began with Safe Harbor in 2000: Europe and the US agreed on a self-certification system for US companies. It was weak from the outset—companies could certify themselves as meeting European data protection standards without any effective verification. Edward Snowden's revelations from 2013 onward empirically demonstrated the extent of US mass surveillance. The European Court of Justice declared Safe Harbor invalid in 2015.

The second act came in 2016 with Privacy Shield: more politically ambitious, but hardly tenable from a legal standpoint. The fundamental problems remained: FISA Section 702 allowed US intelligence agencies to monitor non-US citizens without an individual court order, provided they communicated via US communications infrastructure. Executive Order 12333 enabled global mass surveillance without territorial restrictions or judicial oversight. Privacy Shield was invalidated in the summer of 2020.

The third act was the EU-US Data Privacy Framework 2023: technically sophisticated, politically bought, structurally vulnerable. The Biden administration created the DPRC and adjusted intelligence powers by executive order—but neither the US Congress nor an independent court backed it. A presidential decree is not law. And presidents change. In September 2025, the General Court of the European Union dismissed the action for annulment brought by French MEP Philippe Latombe at first instance and upheld the adequacy decision as lawful at that time. Latombe appealed to the Court of Justice of the European Union.

The fourth act now begins: The Supreme Court ruling of June 29, 2026, does not collapse due to a targeted attack on the DPF, but rather due to a domestic US political decision that undermines the foundation upon which the entire edifice rested. NOYB has already sent a formal letter to the European Commission and announced its own legal action. The European Court of Justice thus receives another case before it—and given the clear contractual situation, the outcome can hardly be described as uncertain.

CLOUD Act and FISA 702: The pitfalls that no agreement can overcome

The discussion surrounding the DPF and its potential demise easily obscures the fundamental problem that has accompanied every transatlantic data transfer agreement since 2000: US law has extraterritorial reach, and this is inherent to the system, not remediable by voluntary commitments.

The CLOUD Act of 2018 obligates US companies to hand over data to US authorities upon request—regardless of where that data is physically stored. The law arose directly from the Microsoft Ireland case, in which Microsoft had for years refused to hand over emails stored in Dublin to the FBI. Now, the decisive factor is not the storage location, but rather control over the data. A US parent company that controls a European subsidiary can be compelled to hand over data, even if the servers are located in Frankfurt.

A legal opinion commissioned by the German Federal Ministry of the Interior and made available via the Freedom of Information Act, prepared by the University of Cologne, concludes that US authorities have extensive access to data stored in European data centers. The consequences are virtually impossible to circumvent technically, even through encryption: If a cloud provider excludes itself from data access through technical measures, it risks substantial fines or criminal prosecution under US procedural law, as the obligation to retain data begins even before legal proceedings commence.

In July 2025, Microsoft executives explicitly admitted to the Swiss IT Magazine that they could not guarantee that data would not be shared with US authorities. The same Microsoft legal advisor confirmed under oath before the French Senate: "Non, je ne peux pas le garantir" — no, the security of European citizens' data from US government access cannot be guaranteed. While sovereign cloud products like Microsoft's Delos Cloud, AWS Sovereign Instances, or Google Distributed Cloud exist, they do not alter the fundamental legal obligation to US authorities.

According to available market data, the European cloud market is dominated by US providers to the tune of approximately 83 percent. In 2024 alone, European companies spent roughly $25 billion on cloud services from the five largest US providers. This structural dependency is the real economic dilemma that no data protection agreement can resolve—it makes Europe a tenant on its own turf.

Our US expertise in business development, sales and marketing - Image: Xpert.Digital

Industry focus areas: B2B, digitalization (from AI to XR), mechanical engineering, logistics, renewable energies and industry

More information here:

• Expert Business Hub

A thematic hub offering insights and expertise:

• Knowledge platform covering global and regional economies, innovation and industry-specific trends
• A collection of analyses, insights, and background information from our key areas of focus
• A place for expertise and information on current developments in business and technology
• A hub for companies seeking information on markets, digitalization, and industry innovations

Economic consequences: What happens when the DPF falls?

Legally, the situation is clear: The European Commission's adequacy decision remains formally in force until it is overturned either by the Commission itself or by a ruling of the European Court of Justice. There will therefore be no immediate "digital blackout." However, the economic implications of the foreseeable legal proceedings are considerable.

Should the European Court of Justice (ECJ) declare the Data Protection Fund (DPF) invalid, companies will lose the most convenient legal basis to date for transatlantic data transfers. What remains are Standard Contractual Clauses (SCCs) and Binding Corporate Rules (BCRs). Both instruments are more legally demanding, as the Schrems II ruling requires an individual risk impact assessment—the so-called Transfer Impact Assessment. This assessment must realistically evaluate whether the legal and factual conditions in the recipient country guarantee sufficient protection—something that, following the recent Supreme Court ruling, can hardly be considered a positive outcome.

NOYB explicitly emphasizes that companies that do not rely directly on the DPF, but on SCCs and BCRs, are also affected: Their internal risk assessments typically rely on US institutions formerly considered independent, such as PCLOB (Privacy and Civil Liberties Oversight Board) or the DPRC — institutions that have also been deprived of their presumed independence by the Supreme Court ruling.

The Federation of German Industries (BDI) warned as early as spring 2025 that the failure of the Digital Finance Framework (DPF) would have "devastating consequences" for German industry and lead to "significant additional costs and legal uncertainty." These additional costs affect not only legal departments but the entire digital infrastructure of companies, government agencies, and public bodies. Numerous administrative processes, citizen apps, cloud-based ERP systems, CRM platforms, email services, and collaboration tools would be directly impacted. The costs of a forced reassessment of all third-country transfers, supplemented by potential fines and compliance expenses, are difficult to quantify precisely—the discussion suggests figures in the tens of billions of euros for the German economic area alone.

For public authorities and critical infrastructure, the situation is even more serious: police, municipalities, state authorities, utility companies, financial service providers—all face regulatory requirements regarding the verifiability of their data control. KPMG already pointed out in January 2026 that financial institutions should examine exit strategies and prepare backup solutions.

Related to this:

• USA | Secret BMI (Federal Ministry of the Interior) report reveals the illusion of digital sovereignty

Digital sovereignty: Rhetoric meets reality

The demand for "digital sovereignty" has been a political mantra in European capitals for years. What the Trump v. Slaughter ruling ruthlessly exposes is the gap between this claim and the actual dependence on infrastructure.

According to the member states' roadmap, Europe plans to invest €288.6 billion in digital infrastructure—71 percent of which will come from public funds. By comparison, the US private sector invests over $200 billion annually in digital infrastructure alone. This discrepancy in investment volume and development speed explains why Europe is trapped in a structural dependency on US hyperscalers, a situation that cannot be resolved through political decisions alone.

At the same time, companies listed on US stock exchanges—including Deutsche Telekom—are generally subject to the CLOUD Act and thus obligated to disclose information to US authorities. The concept of a sovereign cloud, which is nevertheless provided to European companies by US corporations, proves to be structurally contradictory. Even if data is technically processed in Frankfurt, legal control lies in Seattle, San Francisco, or New York.

True digital sovereignty requires a European contractual partner, European law, no US parent company, and its own infrastructure in European data centers. This solution exists—open-source alternatives like Linux, LibreOffice, and European cloud providers—but it requires a willingness to invest, skilled personnel, and political will. The latter, in particular, has rarely been present in a procurement policy driven by competition and cost efficiency.

The Commission under pressure: Scenarios for the coming years

On June 29, 2026, NOYB immediately sent a formal letter to the European Commission demanding its obligation to orderly revoke the adequacy decision. Max Schrems succinctly stated the demand: “Under pressure from industry, the Commission has built a legal house of cards. Now that it is clearly collapsing, it must take responsibility.”

The EU Commission's initial reaction was muted: they would analyze the ruling and examine the consequences. This is understandable from a procedural standpoint, but politically it is no response to a situation that has substantially materialized. Three realistic scenarios are emerging:

The first scenario is an orderly withdrawal: The EU Commission itself revokes the adequacy decision, grants companies a transition period, and coordinates alternative legal instruments. This would be legally consistent, politically painful—and would exert transatlantic economic pressure on the US to resolve the issue.

The second scenario is the ECJ proceedings: NOYB files a lawsuit. According to its own statements, the proceedings will take two to three years. During this time, the adequacy decision remains formally valid, companies operate in legal uncertainty, and data protection authorities could exert increasing pressure. The likely outcome is a Schrems III ruling by the ECJ—the annulment of the third agreement in a row.

The third scenario is a political arrangement: The US and the EU negotiate a new framework that eliminates the structural weaknesses—that is, genuine legislative changes in the US Congress instead of presidential decrees. Given the current political dynamics in Washington and the “Unitary Executive Theory” of the conservative majority on the Supreme Court, this appears to be the least likely scenario.

Cybersecurity expert Kolochenko outlines a cautiously optimistic middle ground: “A further revision of the current EU-US data transfer regime is inevitable—hopefully this time less radical and painful for companies on both sides of the Atlantic.” This hope may be justified—but it assumes that there is a strategic will on both sides to create a permanently sustainable framework, not just the next politically motivated interim solution.

Structural weakness as a permanent condition: What this crisis really reveals

The real lesson from the history of Safe Harbor, Privacy Shield, and the Data Privacy Framework is not legal—it is strategic. Europe has tried three times to solve a structural problem through an institutional agreement without addressing the underlying problem: the fact that US surveillance law and the European fundamental right to privacy are in irreconcilable tension.

FISA Section 702 and the CLOUD Act are not flaws in the US system—they are expressions of a deliberate political will to maintain global information dominance. As long as this will prevails and Europe lacks its own robust digital infrastructure, any agreement will be built on shaky foundations. The house-of-cards metaphor, which NOYB has used since the first day of the DPF, proves in retrospect to be an accurate description, not a polemical exaggeration.

The Trump v. Slaughter ruling didn't create anything new—it made visible what was always there. The US president always had the power to revoke the Biden administration's executive order and thereby eliminate Executive Order 14086, on which the DPRC was based. That the disentanglement occurred not through this avenue, but through a constitutional ruling, is almost a legal irony: The Supreme Court didn't willfully topple the house of cards—it merely clarified that the FTC was never truly the independent anchor the commission had treated it as.

Recommendations for action: What companies and institutions need to do now

Companies that transfer personal data to the US based on the DPF (Data Protection Framework) must take immediate action—even though the adequacy decision is still formally valid. The timeline of upcoming proceedings makes it clear that the question is not whether the DPF will be overturned, but when.

First, a complete inventory of all data transfers to the USA must be conducted—cloud services, analytics tools, newsletter platforms, payment service providers, CRM systems, HR software. For each transfer, it must be examined whether alternative legal bases (SCCs, BCRs) exist and whether a transfer impact assessment still considers the current legal situation sufficiently secure. In light of the Supreme Court ruling, a positive assessment for sensitive data categories is hardly justifiable anymore.

In the medium to long term, there is no way around evaluating European alternatives. This does not necessarily mean a complete withdrawal from US platforms—but it does mean strategically distinguishing between services where a European alternative exists and is feasible, and those where this is not currently the case. This process is long overdue, especially for regulated industries, government agencies, and companies handling sensitive customer data.

The Data Protection Foundation aptly summarized the situation: A European solution is urgently needed, particularly for use by governments, authorities, public bodies, and companies operating in critical infrastructure. Those who ignored this demand from 2025 now face a forced acceleration of the process.

Epilogue: This was foreseeable — and will be expensive

The question being asked in European legal departments, data protection authorities, and IT departments on the evening of June 29, 2026, was less "What happened?" than "Why didn't anyone prepare?" The answer is uncomfortable: because it was more convenient to wait for the next agreement than to implement structural changes. Because industry lobbying prioritized short-term planning security over long-term legal compliance. And because the European Commission succumbed three times in a row to pressure to issue adequacy decisions whose internal logic was flawed from the outset.

Max Schrems' characterization of the DPF as a "house of cards under industrial pressure" has now received judicial confirmation—albeit from Washington, not Luxembourg. This is the real irony of the story: Europe had to wait for an internal US ruling on executive power to expose a weakness that European data protection lawyers have been pointing out for years.

What happens next depends on three variables: the pace and determination of the European Commission, the outcome of the expected European Court of Justice proceedings, and the political willingness of the US to reform its surveillance laws in such a way as to make a lasting and sustainable agreement possible. The third variable currently seems the most distant—because Washington has remained Washington.

☑️ Our business language is English or German

☑️ NEW: Correspondence in your native language!

Konrad Wolfenstein

I and my team are happy to be available to you as your personal advisor.

You can contact me by filling out the contact form here [email protected]:or simply call me at +49 7348 4088 965. My email address is

I'm looking forward to our joint project.

☑️ SME support in strategy, consulting, planning and implementation

☑️ Creation or realignment of the digital strategy and digitization

☑️ Expansion and optimization of international sales processes

☑️ Global & Digital B2B trading platforms

☑️ Pioneer Business Development / Marketing / PR / Trade Fairs

The quasi-in-house solution: How Xpert.Digital closes operational gaps in B2B marketing and sales – Smart Content-Driven Business - Image: Xpert.Digital

Xpert.Digital is a data-driven B2B industry hub led by Konrad Wolfenstein . The company acts as an external, quasi-in-house solution for industrial partners, closing operational gaps in marketing, content, and sales – without requiring additional resources on the client side.

More information here:

• The quasi-in-house solution: How Xpert.Digital closes operational gaps in B2B marketing and sales – Smart Content-Driven Business