Is Max Schrems about to slaughter the EU-US Data Protection Framework?
By Dr Tristan Jenkinson
Summary
While this may sound like an advert for a reboot of Celebrity Deathmatch, it is a serious data privacy concern. There is a significant risk that the latest framework put in place to protect the data of EU citizens transferred to the US could be invalidated, putting data transfers between the EU and US in limbo.
In the US Supreme Court Decision “Trump v Slaughter”, it was decided that Donald Trump could remove commissioners from the FTC at will
This has led to concerns that the FTC (and other US government authorities) can no longer be viewed as independent
Privacy advocate Max Schrems is calling for the EU-US Data Privacy Framework to be invalidated as there is no independent authority in control of the framework
The EU-US Data Privacy Framework is the latest of three legal frameworks put in place to safeguard the personal data of EU citizens upon transfer to the US.
Previous iterations, Safe Harbour and Privacy Shield respectively, have both been invalidated as a result of legal action from Max Schrems.
If invalidated, it could severely impact those companies who rely on it for centralisation of internal company information in the US, or those seeking a transatlantic transfer of data for use in litigation based in the US.
The EU-US Data Privacy Framework
The EU-US Data Privacy Framework was adopted in July 2023, as covered in this press release.
The framework included additional safeguards to improve upon Privacy Shield and Safe Harbour. These include restricting access to US authorities to what is necessary and proportionate to protect national security and the creation of a new Data Protection Review Court.
The press release highlights that “The Framework is administered and monitored by the US Department of Commerce. The US Federal Trade Commission will enforce US
companies' compliance.”
Trump v Slaughter
Rebecca Slaughter was a Democratic commissioner of the Federal Trade Commission (“FTC”) in the US.
In January 2025, US President Donald Trump fired Slaughter. Rather than providing any basis for their dismissal, Slaughter was informed that her services were not consistent with the priorities of the Trump administration. This was challenged by
Slaughter, and the case eventually made its way to the US Supreme Court. The Supreme Court upheld the President's removal of Slaughter, overturning a 1935 decision, Humphrey’s Executor v United States.
Ultimately, the Humphrey’s Executor case (which the Supreme Court overturned) boiled down to answering two questions:
Can the President only remove an FTC Commissioner for “cause” (as stated in the Federal Trade Commission Act)
If so, is this restriction constitutional?
The Humphrey’s Executor case (somewhat emphatically) declared that the answer to both questions was “yes”.
As summarised by Dentons in their article:
“As a result, the President now has unchecked authority to remove such leaders of agencies that exercise executive power, as any statutory “for cause” protections are now unconstitutional. ”
And further (emphasis from the original publication):
“ Independent agencies are no longer independent —The President now controls the policy decisions of these agencies.”
Schrems III
On 29 June 2026 (the day that the decision in Trump v Slaughter was published), Max Schrems posted on LinkedIn that he was looking at the details.
On 30 June 2026, Schrems posted details of a letter which they had sent to the EU Commission, asking them to start an orderly exit from the EU -US Data Privacy Framework. The letter can be found here.
The letter from Schrems highlights key points relating to independence – with the Data Privacy Framework requiring an independent authority, and the fact that the FTC (the appointed authority in the US) is no longer considered independent.
There are two main thrusts in Schrems’ argument that the EU-US Data Privacy Framework requires an independent authority to implement or control it:
Article 16 (paragraph 2) of the Treaty of the Functioning of the European Union and
Article 8 (paragraph 3) of the EU Charter of Fundamental Rights
Essentially, both of these state that compliance with the rules put in place by the EU will be subject to the control of an independent authority.
What Next?
It appears likely that Max Schrems will continue to push for an “Orderly Exit” from the EU-US Data Privacy Framework. This may or may not result in the decision being declared invalid. Even if it does, as the article on nyob explains:
“…such a lawsuit typically takes 2-3 years until a final decision is reached.”
While it may be some time before direct impact, an invalidation of the framework would impact companies that have centralised functions based in the US and may be transferring data there. Not only that, but it could constitute a challenge for US companies to utilise the data from European subsidiaries in US-based litigation, or regulatory responses. This may then require data minimisation exercises to be undertaken in Europe, and checking relevant procedures are in place to transfer the resulting minimised data to the US.
Having been in this position twice before (after the invalidation of Safe Harbour and Privacy Shield) it may be easy to assume that companies would have secondary transfer mechanisms in place, but this is not always the case, especially for companies that may have been incorporated in the meantime.
This remains an important topic to monitor for those interested in data privacy, and especially its impact on cross-border data transfers.
Sky Discovery has experience assisting companies with collections and reviews in the UK and Europe to support such scenarios, as well as ensuring that relevant safeguards are in place when data does require transfer. This might include, for example, various data minimisation efforts prior to the onward transfer of data.
