NOYB warns of new CJEU challenge to EU-US data transfers deal

On Monday, 29 June 2025, the US Supreme Court ruled that President Donald Trump has the authority to fire the leaders of independent agencies and commissions, overturning a 90-year-old court precedent that had limited executive power. The 6-3 decision in Trump v Slaughter focused on the White House's termination of Federal Trade Commission (FTC) member Rebecca Slaughter via email in March 2025. 

This landmark decision has significant implications for international data transfers under the EU-US Data Privacy Framework (DPF). 

Following the ruling, the Austrian digital rights advocacy group NOYB formally wrote to the European Commission calling for it to withdraw its adequacy decision on the US. NOYB highlights that, under EU treaty law and the Charter of Fundamental Rights, data protection oversight must be carried out by an independent authority. As a consequence, any third country seeking to benefit from the free flow of data must have "essentially equivalent" protections.

Because the EU relied on the FTC's independence as a data protection authority (DPA), NOYB argues that the structure of the EU-US Data Privacy Framework has effectively collapsed.

While NOYB hopes the Commission will act independently, it confirmed that it will file a lawsuit in the coming weeks, aiming to allow the Court of Justice of the European Union (CJEU) to annul the current deal. 

In a related post, the Open Rights Group (ORG) highlights serious implications for the UK following the US Supreme Court judgment. As data flows between the UK and US rely on a UK extension of the DPF, its invalidation will make transatlantic personal data transfers unlawful. Furthermore, ORG argues that alternative workarounds, like standard contractual clauses (SCCs), are ineffective against US state surveillance, whilst complex encryption fixes are unfeasible for many organisations. While the Data (Use and Access) Act 2025 (DUA Act) grants the UK government powers to authorise data transfers to countries lacking independent oversight of data protection complaints, ORG warns that exercising this option risks invalidating the UK's adequacy decision with the EU. ORG concludes that the UK should move away from its dependence on US technology and establish digital sovereignty. 

Legal analysis by Pinsent Masons. 

Training Announcement: Freevacy offers a range of independent data protection qualifications from IAPP and BCS. Our certified courses are available at foundation and practitioner levels and cover multiple legal jurisdictions, data protection operations management, and the implementation of complex privacy solutions in technical environments. Find out more.