Trump v. Slaughter and the EU-US Data Privacy Framework: Why 2026 Is the Year to Prepare for Schrems III

When the US Supreme Court issued its emergency order in Trump v. Slaughter in 2025, the immediate headlines focused on the President's power to remove FTC Commissioners. For privacy professionals, the more consequential question was different: if the FTC is no longer structurally independent, can the EU-US Data Privacy Framework (DPF) survive its next date with the Court of Justice of the European Union (CJEU)?

The short answer is that the DPF's legal basis is now under renewed strain—not because the Supreme Court "declared the FTC unconstitutional," but because the ruling and the parallel collapse of the Privacy and Civil Liberties Oversight Board (PCLOB) quorum undermine the two separate pillars on which the European Commission's adequacy decision rests. As 2026 approaches, organizations relying on DPF certification or Standard Contractual Clauses (SCCs) should treat a third Schrems challenge as a live scenario, not a theoretical one.

This content is for informational purposes only and does not constitute legal advice.

1. What Trump v. Slaughter Actually Held—and Why the Procedural Posture Matters

Precision is essential here, because much of the commentary has overstated the ruling. In Trump v. Slaughter, the Supreme Court did not issue a final merits judgment declaring the FTC unconstitutional. The 2025 posture was an emergency-stay application in which the Court allowed the removal of FTC Commissioners to proceed while litigation continues—an order permitting removal, not a definitive constitutional holding. Organizations should verify the current status of the litigation and any subsequent merits opinion before relying on specific characterizations.

What the order signals, however, is significant: a majority of the Court appears receptive to the argument that the FTC's for-cause removal protections for Commissioners are inconsistent with Article II. If that view is ultimately confirmed on the merits, the FTC would become an executive agency subject to at-will presidential removal—a structural shift with direct implications for how EU regulators assess the durability of US oversight commitments.

Two points of constitutional reasoning matter for privacy:

• Article II and removal power. The argument is that Congress cannot insulate agency heads exercising substantial executive power from presidential control. Multi-member commissions with for-cause removal protections—the FTC, the PCLOB, and others—are the target.
• Independence as a legal fiction. If Commissioners serve at the President's pleasure, then policies, enforcement priorities, and even the continued existence of specific oversight functions can change with each administration. That is precisely the kind of volatility the CJEU has treated as fatal to adequacy.

Separately—and more directly damaging to the DPF—the PCLOB lost its quorum in 2025 following member removals, leaving the board unable to function as intended. The PCLOB is not a peripheral player in the DPF architecture; it is one of the bodies the European Commission expressly relied on in its adequacy decision.

2. The DPF Rests on Two Pillars—and Both Are Under Pressure

A common analytical error is to treat the FTC as the linchpin of the DPF's surveillance safeguards. It is not. The adequacy decision rests on two distinct limbs, each supported by different institutions.

Pillar One: Commercial enforcement (the FTC's domain)

The FTC enforces the DPF's commercial Framework Principles—onward transfer restrictions, data-use limitations, and recourse mechanisms for EU individuals whose data is mishandled by certified companies. Here, the FTC's independence matters because the Commission's adequacy analysis assumes a stable, politically insulated enforcer that will not abruptly deprioritize DPF enforcement.

Pillar Two: Surveillance and redress (the PCLOB, DPRC, and inspectors general)

The Schrems II "essentially equivalent" analysis turns on US surveillance law and the redress available to non-US persons. That limb rests on Executive Order 14086, the Data Protection Review Court (DPRC), the PCLOB's oversight role, and the inspectors general of the intelligence community—not the FTC. The PCLOB's loss of quorum therefore strikes at the heart of the very mechanism the Commission relied on to satisfy the CJEU.

This distinction matters for compliance strategy. Even if the FTC question is eventually resolved in a way that preserves its enforcement role, the PCLOB dysfunction independently weakens the DPF's surveillance pillar. And if the FTC's removal protections fall, the commercial pillar loses the independence the Commission assumed.

"The Commission's decision remains formally in force until repealed or annulled—but that is a statement about legal form, not about legal risk."

3. The Schrems Lineage: Why a Third Challenge Is Likely

The DPF is the third attempt at a stable EU-US transfer regime, and the CJEU has invalidated the first two:

• Schrems I (2015): Safe Harbor invalidated because US surveillance law did not provide essentially equivalent protection and lacked effective redress for EU individuals.
• Schrems II (2020): Privacy Shield invalidated for the same core reasons, with the Court emphasizing the absence of proportionality limitations and independent oversight of FISA 702 surveillance.
• Schrems III (pending): noyb has signaled it will challenge the DPF, and the CJEU is the likely forum.

It is important to characterize noyb's position accurately. Max Schrems' organization has consistently argued that the DPF is a "copy of Privacy Shield" that fails to address the underlying problem—US surveillance law, particularly FISA 702, which was not reformed to provide privacy protections for non-US persons. The FTC independence question is a newer and additional vulnerability, not the core of noyb's historical critique. Any analysis that attributes a Schrems-adjacent position on FTC independence to noyb without evidence risks misrepresenting the record.

The Irish Data Protection Commission (DPC) will again be central. As the lead supervisory authority for many large US tech companies, the DPC has historically been reluctant to halt transfers, and its resistance was repeatedly overturned by the CJEU and the European Data Protection Board (EDPB) in the decade-long Meta litigation. The DPC's eventual posture toward the DPF—and any EDPB override—will shape how quickly companies face enforcement pressure.

4. Practical Impact: What US and EU Companies Should Expect in 2026

For US companies certified under the DPF, the framework remains legally valid until the Commission repeals or the CJEU annuls it. But "valid" is not the same as "safe." Three practical consequences follow:

(a) DPF-certified US companies

• Customers and partners will increasingly ask for SCC fallbacks or supplementary measures as a condition of renewal.
• DPF certification should be maintained—it remains a lawful transfer mechanism—but it should not be the sole basis for high-risk transfers.
• Contractual representations about the durability of US oversight should be revisited with counsel.

(b) EU exporters relying on SCCs and BCRs

• Transfer impact assessments (TIAs) that previously concluded US oversight was "independent and effective" may no longer be defensible.
• BCRs and SCCs that depend on the PCLOB's oversight function need updated analysis, particularly where transfers involve data subject to FISA 702.
• Supplementary measures—encryption, pseudonymization, EU-based processing—should be reassessed for operational feasibility.

(c) Enforcement risk

The Meta €1.2 billion fine (May 2023, following the EDPB's April 2023 binding decision) predates the DPF's operation and concerned SCC-based Facebook transfers; it is not direct evidence of post-Slaughter escalation, and it remains under appeal. Its relevance is as a precedent for the scale of penalties when transfers are found unlawful—not as a forecast of immediate enforcement.

5. A 2026 Compliance Roadmap: Don't Wait for Invalidation

The single biggest mistake organizations can make is to treat formal invalidation as the trigger for action. By then, the window to implement fallbacks and renegotiate contracts will have closed. The following roadmap should be executed now, with milestones through 2026.

Step 1: Map and classify transfers (Q1 2026)

• Inventory all EU-to-US data flows, including sub-processor and onward-transfer chains.
• Flag transfers involving data potentially subject to FISA 702 (cloud, communications, HR data).
• Distinguish DPF-reliant transfers from SCC- and BCR-reliant transfers.

Step 2: Refresh transfer impact assessments (Q1–Q2 2026)

• Reassess the independence and effectiveness of US oversight in light of Trump v. Slaughter and the PCLOB quorum loss.
• Document the legal and factual basis for each conclusion; avoid boilerplate TIAs that simply recite the adequacy decision.
• Consult counsel on whether current TIAs remain defensible.

Step 3: Implement SCC fallbacks (Q2 2026)

• Negotiate SCCs (2021 modules) alongside DPF certification, with clear precedence rules.
• Add supplementary measures where feasible: encryption with EU-held keys, pseudonymization, data localization for the most sensitive categories.
• Update BCRs and intra-group agreements to reflect the new risk environment.

Step 4: Monitor for Schrems III and regulatory signals (ongoing through 2026)

• Track noyb filings, EDPB opinions, DPC decisions, and Commission statements.
• Watch for any Commission review of the DPF and for CJEU scheduling.
• Maintain a multi-jurisdiction view—UK adequacy, Swiss-US arrangements, and other transfer regimes may be affected by similar dynamics.

Tools such as AIGovHub's cross-border transfer assessment and multi-jurisdiction compliance monitoring can help teams maintain a current view of these developments and document their transfer decisions. (Capabilities described are general; organizations should confirm current coverage for their jurisdictions.)

Key Takeaways

• Procedural precision matters: Trump v. Slaughter was an emergency-stay order permitting removal, not a final merits holding; verify current status before relying on characterizations.
• Two pillars, two threats: The DPF's commercial enforcement rests on the FTC; its surveillance and redress limb rests on Executive Order 14086, the DPRC, and the PCLOB. Both are under pressure.
• The PCLOB quorum loss is the more direct vulnerability: It strikes at the oversight body the Commission expressly relied on.
• Schrems III is a live scenario: noyb's core critique remains the absence of FISA 702 reform, not FTC independence alone.
• 2026 is the preparation year: Refresh TIAs, implement SCC fallbacks, and monitor regulatory signals now—do not wait for formal invalidation.

Conclusion: Prepare Now, Not After the Ruling

The DPF remains in force, but its foundations are visibly stressed. The Supreme Court's Trump v. Slaughter order and the PCLOB's dysfunction have created a genuine risk that the CJEU will be asked—again—to decide whether US oversight is "essentially equivalent" to EU standards. Companies that begin mapping transfers, refreshing TIAs, and implementing SCC fallbacks in early 2026 will be positioned to adapt quickly if the framework falls; those that wait will be negotiating from a standing start.

For teams managing this complexity, AIGovHub's compliance toolkit—including transfer assessment and multi-jurisdiction monitoring—can support a structured, documented approach. Start with a data mapping exercise this quarter, and treat 2026 as the year to build optionality into every EU-US transfer.

This content is for informational purposes only and does not constitute legal advice.