EDPB requests review of EU-US Data Privacy Framework following Trump v. Slaughter

The European Data Protection Board has begun asking formal questions about impacts to the EU-U.S. Data Privacy Framework stemming from the U.S. Supreme Court's Trump v. Slaughter decision on independent agency authority and oversight. The board sent a letter to the European Commission requesting it "closely assess" how the ruling might affect the U.S. Federal Trade Commission's posture and ability to uphold DPF commitments.

"The EDPB wishes to highlight that the existence and effective functioning of one or more independent supervisory authorities in the third country, with responsibility for ensuring and enforcing compliance with the data protection rules, is one of the key elements to be taken into account when assessing the adequacy of the level of protection in a third country," EDPB Chair Anu Talus wrote to European Commissioner for Democracy, Justice, the Rule of Law and Consumer Protection Michael McGrath in the 31 July letter.

Talus also noted the DPF's explicit references to FTC independence and a U.S. president's ability to remove a commissioner only for "inefficiency, neglect of duty, or malfeasance in office." 

The Supreme Court ruling runs counter to DPF independence commitments, with U.S. President Donald Trump removing former FTC Commissioner Rebecca Kelly Slaughter because he deemed her work to be "inconsistent with (the) Administration's priorities."

The European Commission did not immediately respond to the IAPP's requests for comment on the matter. McGrath had not publicly raised concerns in the leadup to the Supreme Court ruling, noting in April the DPF was "mutually beneficial to both sides."

"There is recognition in the U.S., and certainly there is on the European Union side that there is too much at stake to allow (the DPF) to slip," McGrath said. "We know that many large U.S. companies that are the direct beneficiaries of the DPF are on the same page as us in that respect."

McGrath met with EDPB members during its June plenary, as noted in Talus' letter. Following that dialogue, the board held a more focused conversation on potential Trump v. Slaughter impacts at the July plenary.

Clarity required

While the Commission ponders the EDPB's request, onlookers remain split on what the Trump v. Slaughter ruling actually means for the DPF. While standard contractual clauses and binding corporate rules would still be viable transfer mechanisms, a range of businesses continue to rely on the DPF for their EU-U.S. transfer needs.

NOYB Honorary Chair Max Schrems, who spearheaded challenges that led to the invalidation of the DPF's two predecessor frameworks, told the IAPP "the deal is done" following the decision. He referenced a "clash at the constitutional level," with the ruling on independence creating a perceived breach of the Charter of Fundamental Rights of the European Union, and potential political conflicts of interest as well.

"The Commission is not a legal, but a political body. The approach under (European Commission President) Ursula von der Leyen was to just not provoke the irrational Trump administration. So while the situation seems legally obvious, the signals we get is that they will try to keep this topic under the rug until the (Court of Justice of the European Union) forces it back out."

Schrems had been preparing the next legal challenge prior to the latest development, noting NOYB is "actively working on a lawsuit to put the matter back before the CJEU."

There is a case to be made for a status quo approach to the situation, according to Wilson Sonsini Goodrich & Rosati Partner Maneesha Mithal, the former head of the Division of Privacy and Identity Protection at the FTC. During a recent IAPP LinkedIn Live, Mithal the FTC remains steadfast and "has not shown any retreat from commitments to enforce privacy process."

"I think there's an argument that it wouldn't change those other forms of data transfers," she added.

In a recent op-ed for the IAPP, University of Grenoble Alpes' Théodore Christakis, Georgetown University's Kenneth Propp and Alston & Bird's Peter Swire, CIPP/US, offered their analysis of why data transfers do not stand nor fall with FTC and how Trump v. Slaughter does not apply equally to the DPF's redress mechanism.