Transatlantic data transfers are the horror franchise of privacy law. Just when everyone agrees the monster is dead, a sequel gets greenlit. Safe Harbour fell in 2015 (Schrems I). Privacy Shield followed in 2020 (Schrems II). Its successor, the EU–US Data Privacy Framework (DPF), has been running since 2023. On June 29th, 2026, the US Supreme Court may have handed the writers their next script.
What happened in Washington, DC
In Trump v. Slaughter, the Supreme Court held 6–3 that the statute allowing FTC Commissioners to be removed only for “inefficiency, neglect of duty, or malfeasance in office” violates the separation of powers. In doing so, it overruled Humphrey’s Executor v. United States, the 1935 precedent that had anchored the concept of “independent” US agencies for ninety years. FTC Commissioners now serve the President, like most senior executive officers. The case arose from the March 2025 removal of Commissioners Slaughter and Bedoya, based on the President’s Article II authority rather than the statutory grounds. This position was now confirmed by the Supreme Court.
The Supreme Court carved out the Federal Reserve (markets get a special constitutional comfort blanket) and left non-Article III courts for another day. Everyone else in the alphabet maze of US agencies now reports, in the fullest sense, to the President.
Panic in Brussels
Here is the awkward part. The European Commission’s adequacy decision underpinning the DPF leans heavily on the FTC as the independent authority enforcing the framework’s commercial principles. Article 45(2)(b) GDPR makes “independent supervisory authorities” in the third country a core ingredient of adequacy. It is now, as a matter of US constitutional law, an ingredient the US cannot supply.
And this is not the framework’s first wobble. The Privacy and Civil Liberties Oversight Board was reduced below quorum in January 2025, and the independence of the Data Protection Review Court (the Schrems II fix) has been questioned ever since.
So… Schrems III?
Max Schrems certainly thinks so. On June 30th, 2026, noyb wrote to the Commission arguing that no independent US oversight authority remains and calling for an orderly withdrawal of the adequacy decision, with litigation to follow if Brussels declines. Meanwhile, MEP Philippe Latombe’s challenge to the DPF, dismissed by the General Court in September 2025, is already on appeal before the CJEU, and Slaughter is exactly the kind of ammunition an appellant dreams of. The Commission, for its part, has “taken note” of the ruling and is “analyzing the implications” which is Brussels for quietly re-reading Article 45(5).
Our honest read: the DPF remains valid today, and nothing collapses this week. But the framework now rests on an adequacy finding whose factual premises have been overruled by the highest court of the country it assesses. Whether the end comes by Commission withdrawal, the Latombe appeal, or a fresh reference from a national court, the direction of travel looks unpleasantly familiar. Sequels take time. Schrems II took five years, but this one has a strong pitch deck.
What should you do now?
Nothing dramatic; everything sensible. Map which of your data flows rely on the DPF. Have Standard Contractual Clauses and transfer impact assessments ready, ideally already signed as a parallel mechanism. Build flexibility into new contracts so a change of transfer tool does not require a renegotiation. And if you are a Serbian company, the plot is even messier: Serbia’s adequacy list still includes the US Privacy Shield Framework, even though the Commissioner for Information of Public Importance and Personal Data Protection has stated that framework is invalid and cannot be relied upon, as far back as Schrems II. Until the list catches up, US transfers under the Personal Data Protection Act of the Republic of Serbia, sit in a legal grey zone and if you process EU personal data or sit in an EU group structure, this affects you just as much as your parent in Frankfurt or New York.
The monster is not dead. It never is. Time to take action is before the sequel premieres.
This article is general information, not legal advice. For an assessment of your specific transfer arrangements, contact the Refine Legal data protection team.