Frankfurt: The arrangement that lets European companies move personal data to the United States has survived one legal near-death experience after another, and it may be heading for its third. On 30 June the campaign group NOYB, founded by the Austrian lawyer Max Schrems, wrote to the European Commission signalling that it is preparing to challenge the EU-US Data Privacy Framework before the Court of Justice of the European Union.
The trigger sits in Washington. On 29 June the US Supreme Court ruled, in Trump v. Slaughter, that statutory limits on a president’s power to remove Federal Trade Commission commissioners are unconstitutional. To European eyes that decision matters far beyond American antitrust, because the adequacy of the transatlantic framework rests partly on the assumption that independent bodies oversee how data is handled. Article 8(3) of the Union’s Charter of Fundamental Rights insists that compliance with data-protection rules be checked by an authority acting independently. If the officials meant to provide that check can be dismissed at will, campaigners argue, the guarantee looks hollow.
The history is not encouraging for the framework’s defenders. In 2015 the Court struck down the Safe Harbour regime in what became known as Schrems I. In 2020 it annulled the successor Privacy Shield in Schrems II. Each time the underlying complaint was similar: that US surveillance powers and oversight arrangements did not offer Europeans protection essentially equivalent to what they enjoy at home. The current framework, adopted in 2023, was designed to answer those objections, and a European court earlier upheld it. A fresh referral would ask whether recent shifts in Washington have quietly undone the fix.
For the thousands of businesses that rely on the framework, from cloud providers to human-resources departments, the stakes are practical rather than abstract. A ruling that unpicked it would force a scramble back to the cumbersome contractual clauses and case-by-case assessments that the framework was meant to replace, with legal uncertainty in the meantime.
Defenders of the arrangement caution against assuming the worst. A single domestic ruling on the removal of commissioners does not automatically collapse an adequacy decision, and the Commission retains tools to monitor and, if necessary, adjust the framework before any court reaches a verdict. Litigation of this kind also takes years, leaving room for political repair.
Still, the pattern is hard to ignore. Twice the Union has built a bridge across the Atlantic for data, and twice its own highest court has judged the foundations too weak. Whether the third attempt fares differently will turn on how much weight the judges give to the independence of oversight, and on whether Europe’s data economy can keep functioning while they decide.




