The legal structure of American administrative governance underwent a seismic shift when the U.S. Supreme Court decided Trump v. Slaughter (No. 25–332). By striking down ninety years of precedent originally established in Humphrey’s Executor v. United States (1935), the Court ruled that statutory "for-cause" removal protections protecting Federal Trade Commission (FTC) Commissioners violate Article II of the U.S. Constitution.
This step has not only given rise to debates over the expansion of executive control over regulatory agencies but has also put international supervisory bodies on high alert. By removing the FTC's statutory independence, the Supreme Court has affected the primary supervisory mechanism that underpins the EU-US Data Privacy Framework (DPF).
Background
Shortly after taking office for a second term, President Donald Trump fired FTC Commissioners Rebecca Kelly Slaughter and Alvaro Bedoya, without citing a statutory ground for the action. As per a century-old law, 15 U.S.C. §41, a President is only allowed to fire an FTC commissioner for a serious reason such as inefficiency, neglect of duty, or malfeasance in office. The White House asserted that its continued service was inconsistent with administrative policy, invoking the President’s Article II executive removal powers.
Commissioner Slaughter filed suit in the U.S. District Court for the District of Columbia, challenging the termination as ultra vires as per the precedent set in Humphrey’s Executor Case. The District Court granted summary judgment for Slaughter and prohibited the executive branch from interfering with her official capacity. Then, the Supreme Court granted certiorari before judgment to decide whether Congress can constitutionally restrict a President’s ability to remove independent agency leaders at will.
Legal Reasoning Behind the Decision
In a 6–3 decision, the U.S. Supreme Court ruled in favor of President Trump and officially overruled Humphrey’s Executor. The key elements of the Court’s ruling were as follows:
- Article II Directives: The Court emphasized that Article II, Section 1 of the U.S. Constitution vests executive power solely in the President, who retains the responsibility under Section 3 to ensure that federal statutes are faithfully executed. To fulfill this duty, subordinate officials executing federal law must remain subject to presidential oversight and at-will removal.
- Historical Precedent: Drawing on the "Decision of 1789" and Chief Justice Taft’s analysis in Myers v. United States (1926), the majority maintained that removing executive officers represents an inherent constitutional authority that Congress cannot restrict by statute.
- Rejection of Humphrey’s Executor: The majority rejected the distinction established in 1935, which categorized the FTC as exercising "quasi-legislative" and "quasi-judicial" responsibilities rather than core executive power. Given that contemporary independent agencies exercise broad enforcement and investigative authority, the Court determined that they exercise executive power and must answer directly to the President.
Impact on EU-US Data Privacy Framework
The EU-US Data Privacy Framework (EU-US DPF) is the legal mechanism that permits personal data to flow from the European Union to companies in the United States. The European Commission adopted it in July 2023, following the Court of Justice's decision in Data Protection Commissioner v Facebook Ireland Ltd and Maximillian Schrems (Case C-311/18) ("Schrems II”), which invalidated its predecessor, the Privacy Shield. It operates as an adequacy decision, a formal determination that the United States affords European data a level of protection essentially equivalent to that guaranteed within the EU. In its absence, transatlantic transfers must rely on more cumbersome safeguards, such as Standard Contractual Clauses.
At first glance, Trump v. Slaughter bears no relation to this regime. The case concerns presidential authority and the removal of FTC commissioners, not data protection or international transfers. Its relevance is indirect but significant. The Framework depends on the Federal Trade Commission as an enforcement authority, and the ruling reshapes the FTC's constitutional standing. A separation-of-powers decision has therefore become a data protection concern. To understand how, it is necessary to examine what the Framework rests upon.
The EU-US DPF rests on two distinct foundations:
- The first is commercial enforcement. When a US company certifies under the DPF, it undertakes binding commitments concerning its handling of European data, and those commitments require an effective enforcer. That role belongs to the Federal Trade Commission. The FTC investigates violations, holds certified companies to their obligations, and provides European individuals with a route to redress on the commercial side.
- The second foundation is government access, which governs the treatment of European data by US intelligence agencies once it reaches American soil. It comprises limits on surveillance and an independent redress body, the Data Protection Review Court, established in response to Schrems II. Trump v. Slaughter affects the first foundation alone. The FTC is the Framework's commercial enforcer, and it is precisely the FTC's independence that the ruling removes.
Independence is not incidental to this structure. Under EU law, supervision of data protection must be carried out independently, and this is a legal requirement rather than a matter of preference. It is enshrined in Article 8(3) of the Charter and Article 16 of the TFEU, and it underpins Article 45 of the GDPR. Article 45(2)(b) treats the existence of an effective, independent supervisory authority as a key criterion for any adequacy decision. The European Commission was mindful of this when it approved the DPF in 2023. In Implementing Decision (EU) 2023/1795, it characterized the FTC as an independent enforcement authority and relied on the fact that commissioners could be removed only for cause, namely inefficiency, neglect of duty, or malfeasance. That premise no longer holds. Following Slaughter, FTC commissioners serve at the pleasure of the President and may be removed at will. The authority the Commission described as independent is no longer independent in the sense EU law requires, and the essential equivalence on which the adequacy decision depends is now in question.
This is not an unprecedented difficulty. It is the third occasion on which the same fault line has opened. Safe Harbor was struck down in Schrems I, and Privacy Shield in Schrems II. In both instances, the Court of Justice found US oversight bodies insufficiently independent to satisfy EU standards. The DPF was designed to remedy that deficiency, and Slaughter reopens it from a different direction. The earlier cases concerned government surveillance and redress; this one concerns the commercial enforcer. The present difficulty also carries a sharper edge. The earlier failures were addressed through renewed negotiation and a new executive order, whereas this one does not lend itself to so straightforward a repair. The FTC's independence cannot be restored by legislation once the Supreme Court has held such independence to be unconstitutional. The defect is structural, and it may prove more enduring than those preceding it.
EDPB Intervention
The European response was immediate. On 31 July 2026, EDPB Chair Anu Talus wrote to Commissioner Michael McGrath, requesting that the Commission assess closely whether the ruling affects the FTC's capacity to uphold its commitments under the Framework. Her central observation was that an independent supervisory authority is a key element in determining whether a third country provides adequate protection. The letter is not a judgment, and it altered nothing by itself. Its significance lies in its source: when the body that coordinates every data protection authority in Europe asks the Commission to reconsider, the request carries considerable weight.
Civil Society Response (NOYB)
The day after the decision, NOYB - European Center for Digital Rights, a non-profit organization working on the enforcement of privacy laws, petitioned the European Commission to initiate an orderly withdrawal of the adequacy decision, arguing that the constitutional foundation of the agreement has failed. NOYB announced plans to challenge the adequacy decision before the Court of Justice of the European Union (CJEU), laying the groundwork for a third major judicial review of transatlantic data transfers under the EU-US DPF.
Conclusion
Trump v. Slaughter illustrates the friction between domestic separation-of-powers jurisprudence and international regulatory frameworks. By seeking to centralize executive authority over domestic administrative agencies, the Supreme Court altered the structural independence required for cross-border regulatory recognition, forcing multinational enterprises to re-evaluate how personal data is managed across international borders. Organizations managing cross-border data processing must reassess compliance with the U.S. Adequacy Decision as it remains valid until formally revoked by the European Commission or struck down by the CJEU.
