After Trump v. Slaughter, Can State Attorneys General Shore Up the EU-US Data Privacy Framework?

More than four months after the US Supreme Court decided Trump v. Slaughter, the question European privacy teams keep asking has no official answer: does a ruling about who can fire a Federal Trade Commissioner weaken the EU-US Data Privacy Framework? The European Commission says it is analysing the judgment. The European Data Protection Board has asked it to look closely. Nothing has been suspended. Meanwhile, a new idea is circulating among practitioners: if the FTC is no longer formally independent, could other US enforcers, in particular state attorneys general, help reassure Brussels? This article looks at what the ruling actually changed, what the adequacy decision relies on, and how realistic the state-level idea is.

What the Supreme Court decided

In a 6-3 opinion by Chief Justice Roberts, the Court held that the statute allowing the President to remove FTC commissioners only for “inefficiency, neglect of duty, or malfeasance in office” violates the separation of powers. Because the FTC enforces some 80 statutes, writes binding rules, runs in-house adjudication and sues in federal court, the Court found that it “unquestionably exercises executive power” and must be answerable to the President. Whatever remained of the 1935 Humphrey’s Executor precedent, the Court said, it now overrules.

Two limits matter for transatlantic data flows. First, the Court decided only who controls the commissioners. The FTC’s authority under Section 5 of the FTC Act to pursue unfair or deceptive practices, including false claims of participation in the Data Privacy Framework, is unchanged. Second, the Court deliberately left other questions open, including the Federal Reserve and tenure protections for judges of “non-Article III courts.” That carve-out is relevant because the framework’s redress body, the Data Protection Review Court, sits inside the executive branch.

Why Brussels cares: the adequacy decision’s own words

The Commission’s adequacy decision, Implementing Decision (EU) 2023/1795, says an “independent supervisory authority” with monitoring and enforcement powers is needed to guarantee adequate protection in practice. Recital 60 then describes the FTC as “an independent authority” whose commissioners serve seven-year terms and “may only be removed by the President for inefficiency, neglect of duty, or malfeasance in office.” After Slaughter, that sentence no longer describes US law.

On July 31, 2026, EDPB Chair Anu Talus wrote to Commissioner Michael McGrath. She pointed out that independent supervision is a key factor under Article 45(2)(b) GDPR and that the decision refers explicitly to the FTC’s removal protection. She asked the Commission to “closely assess” whether the ruling affects the decision and to keep sharing information with the Board. A week earlier, a Commission spokesperson had said the EU executive had “taken note” of the judgment and would “carefully analyse” its implementation and implications. Neither body has said transfers are affected.

The ruling did not come out of nowhere. The President removed the FTC’s two Democratic commissioners in 2025, and in January 2025 also removed three members of the Privacy and Civil Liberties Oversight Board (PCLOB), which oversees the intelligence side of the framework. The PCLOB has since operated without a quorum, and the challenge by two removed members is set for argument before the D.C. Circuit on November 17, 2026. For background on why one court ruling does not automatically end the framework, see our earlier piece explaining that the Supreme Court did not just kill the Data Privacy Framework.

Independence in form versus enforcement in fact

There are two ways to read the problem, and the Commission’s eventual position will probably sit somewhere between them.

• The formal reading. EU law treats the independence of supervisory authorities as structural. Under the GDPR, members of European regulators can be dismissed only for serious misconduct. If the only US authority named for general commercial enforcement is now removable at will, one pillar of the 2023 finding has changed. The Court of Justice has struck down US transfer frameworks twice before, in Schrems II and earlier in Schrems I, though both cases turned on government surveillance and redress rather than on commercial enforcement.
• The functional reading. Adequacy requires “essentially equivalent” protection, not identical institutions. What matters is whether DPF commitments are actually enforced. That can be measured: FTC cases about the framework, responses to referrals from EU authorities, the Department of Commerce’s administration of the DPF List, and the operation of independent recourse mechanisms. On this view, at-will removal is a risk factor to monitor, not a defect in itself.

The intelligence side is a separate issue. In Latombe v Commission (T-553/23), the General Court upheld the framework on September 3, 2025, relying in part on the fact that Data Protection Review Court judges can be dismissed only by the Attorney General and only for cause. The Court also stressed that the Commission must continuously monitor the US legal framework and can suspend, amend or repeal the decision if that framework changes, according to the court’s press release. Mr Latombe’s appeal (C-703/25 P) is pending before the Court of Justice. If the Justice Department’s for-cause protection for those judges were weakened, the redress analysis would come under much more pressure than the FTC question does.

Could the Commission seek extra assurances?

The adequacy decision already provides the tools. Article 3 requires continuous monitoring. Where protection appears to slip, the Commission must inform US authorities, can ask for remedial steps, and can suspend, amend, repeal or limit the scope of the decision. Its recitals also describe amending the decision by attaching “additional conditions” to transfers. The next scheduled periodic review falls in 2027, three years after the first review report of October 2024, but the Commission can act earlier.

In practice, “assurances” could take several forms, ranging from light to heavy:

1. Written commitments from US officials on how the FTC will handle DPF enforcement and EU referrals, similar to the letters annexed to the 2023 decision.
2. Reporting duties, such as regular public statistics on DPF investigations and outcomes that the Commission can verify at each review.
3. An updated decision that replaces recital 60’s description, records the new legal position and explains why protection remains adequate, possibly with conditions attached.
4. Legislative safeguards, which would require Congress and are the least likely in the short term.

None of these has been announced. Companies should treat them as possible scenarios, not as plans.

Could state attorneys general step in?

The idea has some appeal. Most state attorneys general are elected and answer to their own voters, not to the President, so they cannot be removed by the White House. They have long enforced state consumer protection statutes that prohibit deceptive practices, and a growing number now enforce comprehensive state privacy laws. Kentucky’s attorney general, for example, recently brought the first enforcement action under that state’s new privacy law. A company that falsely claims to comply with the DPF Principles may already be exposed to deceptive-practices claims under state law as well as to the FTC.

The obstacles are just as real:

• No formal role. The framework names the FTC and the Department of Transportation as the competent enforcement authorities. Giving states an official role would require changes on the US side, and the federal government negotiates international arrangements.
• Uneven coverage. State laws, thresholds and enforcement resources differ widely. Adequacy has to work for every participating organisation, wherever it is based.
• Political friction. Federal-state relations on privacy and AI are already tense, with state attorneys general resisting federal preemption proposals. A transatlantic role for states could add to that tension.
• A different kind of independence. Elected prosecutors are independent of the President but are not the expert, depoliticised regulators that EU law has in mind.

Our view: state enforcement is best seen as evidence the Commission could point to, showing that misrepresentations face more than one enforcer, rather than as a replacement for federal oversight. It could support a functional finding of adequacy. It cannot rewrite recital 60.

What companies relying on the DPF should do now

The framework remains valid, and the stakes of disruption are large, as our analysis of the belt-and-braces approach explains. Practical steps include keeping standard contractual clauses in place alongside DPF certification for important data flows, keeping transfer impact assessments current, and not letting certification lapse. Our re-certification reminder covers the annual cycle. Teams should also watch three dates: the D.C. Circuit’s PCLOB argument on November 17, the Court of Justice’s handling of the Latombe appeal, and the 2027 periodic review. Surveillance law matters too, including the Section 702 reauthorisation debate.

Frequently asked questions

Did the Supreme Court say anything about EU data transfers?

No. The opinion deals with US separation of powers. The link to the DPF comes from how the EU’s adequacy decision describes the FTC.

Can the FTC still enforce the DPF?

Yes. Its investigative and enforcement powers are untouched. What changed is that the President can now remove commissioners without cause.

Is the framework suspended or under formal review?

No. The Commission says it is analysing the ruling. The EDPB has asked it to assess the impact. The next scheduled periodic review is in 2027.

Would state enforcement satisfy EU law on its own?

Unlikely. States have no formal role in the framework and their coverage varies. At most, state enforcement could support a broader argument that DPF commitments are enforced in practice.

A bridge with more than one support

The Data Privacy Framework rests on a number of commitments, each from a different institution. Slaughter weakened one of them on paper without, so far, changing what the FTC can do. The way through is likely to be evidence, not new structures: proof that commitments are enforced, reviewed and reported. Organisations that build their transfer strategy on several supports at once will be able to cope with whatever the Commission decides.