EU–US transfers: the DPF holds, so prepare plan B

On 29 June 2026, the US Supreme Court (United States · Supreme Court) ruled, by six votes to three, that the President may freely remove the members of the Federal Trade Commission (United States · FTC), in Trump v. Slaughter. The FTC is the authority that enforces the Data Privacy Framework (DPF), the scheme that has allowed personal data to flow to certified US companies since July 2023. The same day, the privacy group noyb (Austria · noyb) asked the European Commission to repeal the framework and announced a legal challenge.

Legally, nothing has changed: the adequacy decision remains in force, and the EU General Court upheld it in September 2025. But several of the pillars it rests on have moved since its adoption. The DPF is valid today; what has become uncertain is how long it will last.

What is already settled

• The adequacy decision (EU · European Commission): adopted on 10 July 2023 (Implementing Decision (EU) 2023/1795), it allows transfers to US organisations on the official DPF list without further formalities.
• The Latombe judgment (EU · General Court): on 3 September 2025 (Case T-553/23), the Court dismissed the action brought by French MP Philippe Latombe. It found the Data Protection Review Court (DPRC), which handles Europeans’ complaints, sufficiently independent, and recalled that the Commission may “suspend, amend or repeal” its decision if US law changes.
• The appeal (EU · Court of Justice of the EU): Philippe Latombe lodged an appeal on 31 October 2025 (Case C-703/25 P), limited to points of law.
• The FTC (United States · Supreme Court): the 29 June 2026 ruling holds that the protection preventing removal of its members without cause is contrary to the separation of powers.
• The PCLOB (United States · PCLOB): the independent intelligence oversight board has had only one member out of five seats since January 2025, and therefore no quorum. Its review of Executive Order 14086 (25 September 2025) and its Section 702 report (2 April 2026) are staff reports, not approved by a quorate board.
• Executive Order 14086 (United States · White House): signed on 7 October 2022, it underpins the intelligence safeguards and the DPRC redress route. As of 29 October 2026, the Federal Register shows neither revocation nor amendment.
• FISA Section 702 (United States · Congress): the surveillance authority at the heart of the Schrems II ruling expired on 12 June 2026, as it was not reauthorised. Current certifications remain valid until they lapse, one year at most; no law had restored it as of 29 October 2026.

What is still pending

• Appeal C-703/25 P (EU · Court of Justice of the EU): no judgment as of 29 October 2026. As a reminder, the two previous schemes were struck down by the Court of Justice, in 2015 (Safe Harbor) and 2020 (Privacy Shield).
• noyb’s challenge (Austria · noyb): announced on 29 June 2026 for the following weeks, together with a letter asking the Commission for an “orderly” withdrawal of the framework. As of 29 October 2026, we have found no trace of it being filed.
• The Commission’s monitoring (EU · European Commission): the General Court requires it to monitor US law continuously. On 31 July 2026, the European Data Protection Board (EU · EDPB) asked it to assess the effects of the Slaughter ruling on its decision. As of 29 October 2026, it has neither suspended nor amended it.
• The PCLOB’s vacant seats (United States · PCLOB): four out of five, with no nomination announced as far as we know.

The real issue: knowing which pillar the DPF could fall on

The DPF rests on two distinct pillars. The first is commercial: the FTC enforces the commitments of certified companies. The second is national security: Executive Order 14086 limits intelligence access, the DPRC handles complaints, the PCLOB oversees. The Slaughter ruling weakens the first; a PCLOB reduced to one member out of five weakens the second.

The distinction matters for plan B. The European Commission (EU · European Commission) says so itself: US intelligence safeguards apply to all transfers, whatever the tool used. The transfer impact assessments that justify standard contractual clauses today therefore rely on the same Executive Order 14086. If the DPF falls on the commercial pillar, standard clauses remain a solid fallback, because they do not depend on the FTC. If the DPF falls on surveillance, standard contractual clauses wobble with it.

Three points to watch

1. A certification is not a data flow. The DPF covers an organisation listed on the official register, with an active status and for the categories of data it has declared, including human resources data. A provider missing from the list covers nothing.

2. Invisible transfers. A European software vendor may host your data with a US provider or involve US-based support. The transfer exists, even if your contract is signed in Europe. It must appear in your inventory.

3. Article 49 is not a plan B. GDPR derogations, such as explicit consent or performance of a contract, are interpreted strictly. They do not cover the lasting outsourcing of an IT service.

What DPOs and buyers should do

1. Inventory data flows to the United States: recipient, sub-processors, data, legal basis (DPF, standard clauses, binding corporate rules).
2. Check each certification on the official DPF list: active status, data categories covered.
3. Sign standard contractual clauses as a fallback (Decision (EU) 2021/914) with certified recipients, so you can switch without renegotiating.
4. Update transfer impact assessments under Recommendations 01/2020 (EU · EDPB), taking into account the Slaughter ruling, the PCLOB’s lack of quorum and the expiry of Section 702.
5. Strengthen technical measures: encryption with keys held in the EU, pseudonymisation before transfer where the use case allows.
6. Prepare a fallback plan: flows that can be relocated to Europe, reversibility clauses, a realistic switching timeline.
7. Track three signals: the Court’s judgment on the appeal, the actual filing of noyb’s challenge, any Commission decision on the framework.

A well-built transfer survives the annulment of its legal basis.

The question to ask on Monday morning

To your DPO and your CIO: “If the Data Privacy Framework fell tomorrow, which data flows would stop, and how long would it take us to switch them?”