The legal foundation of EU-US data transfers is under formal challenge for the third time in a decade.
On 30 June, privacy organisation noyb sent a formal letter to the European Commission requesting withdrawal of the EU-US Data Privacy Framework adequacy decision. A CJEU challenge is being prepared. The catalyst: the US Supreme Court’s 6-3 ruling in Trump v. Slaughter, which changed the tenure protections for FTC commissioners — an institutional element referenced 259 times in the adequacy decision.
Whether the DPF survives this challenge is a legal question. Whether your organisation can continue transferring data to the US if it doesn’t is an operational one.
The DPF is the third attempt at an EU-US data transfer framework. Safe Harbor was invalidated in 2015. Privacy Shield in 2020. Both were struck down by the CJEU with immediate effect, leaving thousands of organisations without a legal basis for transfers they were already making.
The pattern creates a structural compliance problem: each framework was treated as permanent by organisations that built their transfer architecture around it. Each invalidation forced reactive scrambles — migrating to SCCs, commissioning Transfer Impact Assessments, evaluating data localisation — under time pressure that rewards speed over rigour.
What this means for your compliance team:
→ Assess your current DPF dependency. How many data flows rely solely on the adequacy decision? Every one needs a documented fallback mechanism.
→ Standard Contractual Clauses with Transfer Impact Assessments remain the primary alternative. But TIAs must reflect current US legal conditions — assessments written before June 2026 may need updating.
→ Binding Corporate Rules take 12–18 months to approve. If you haven’t started the BCR process, the window for proactive action is narrowing.
→ Data localisation is the most risk-averse option. If your architecture can isolate EU personal data processing within the EU, quantify the cost now — not after an invalidation forces the decision.
At S8fe.ai, we help organisations map their cross-border data flows and build transfer mechanisms designed to survive legal disruption — because the lesson of three frameworks in one decade is that no adequacy decision is permanent.
Three frameworks. Three challenges. The compliance question is no longer whether your transfer mechanism will be tested — it’s whether it will hold.
Sources:
• https://noyb.eu/en/us-supreme-court-just-blew-eu-us-data-transfers
• https://captaincompliance.com/news/max-schrems-preps-schrems-iii-why-the-eu-us-data-privacy-framework-faces-its-biggest-threat-yet/