NOYB warns of new CJEU challenge to EU-US data transfers deal

On Monday, 29 June 2025, the US Supreme Court ruled that President Donald Trump has the authority to fire the leaders of independent agencies and commissions, overturning a 90-year-old court precedent that had limited executive power. The 6-3 decision in Trump v Slaughter focused on the White House's termination of Federal Trade Commission (FTC) member Rebecca Slaughter via email in March 2025. 

This landmark decision has significant implications for international data transfers under the EU-US Data Privacy Framework (DPF). 

Following the ruling, the Austrian digital rights advocacy group NOYB formally wrote to the European Commission calling for it to withdraw its adequacy decision on the US. NOYB highlights that, under EU treaty law and the Charter of Fundamental Rights, data protection oversight must be carried out by an independent authority. As a consequence, any third country seeking to benefit from the free flow of data must have "essentially equivalent" protections.

Because the EU relied on the FTC's independence as a data protection authority (DPA), NOYB argues that the structure of the EU-US Data Privacy Framework has effectively collapsed.

While NOYB hopes the Commission will act independently, it confirmed that it will file a lawsuit in the coming weeks, aiming to allow the Court of Justice of the European Union (CJEU) to annul the current deal. 

Training Announcement: Freevacy offers a range of independent data protection qualifications from IAPP and BCS. Our certified courses are available at foundation and practitioner levels and cover multiple legal jurisdictions, data protection operations management, and the implementation of complex privacy solutions in technical environments. Find out more.