Last month’s Supreme Court decision in Trump v. Slaughter has created uncertainty about the long-standing position of the independence of the Federal Trade Commission. This, in turn, has prompted Max Schrems and his NGO (NOYB) to renew concerns about the Data Privacy Framework (DPF). They have asked the European Commission to review its conclusion that transfers made to participants in the program were adequate under GDPR. It is based on this that the UK adopted its “data bridge” for UK-US transfers.
The Court’s decision surrounded Trump’s removal of two FTC commissioners. One of them, Slaughter, challenged this decision; however, in its recent decision the court ruled the President could fire Commissioners "at will" and was not restricted to the historic position relating to their conduct in office. According to the Court, the FTC exercises executive power and therefore falls under the authority of the President, who can thus appoint and remove Commissioners without cause.
Schrems argues that as a result of this decision, the FTC is not acting sufficiently independently, and as such cannot be a true independent enforcer of the DPF. And, he argues, it was that independence on which the EU based its adequacy decision. Additionally, he states that reliance on Standard Contractual Clauses (SCCs) or Binding Corporate Rules (BCRs) may similarly be flawed. Namely, because those rely on transfer impact assessments (TIAs) that assume independent oversight by the FTC.
Putting It Into Practice: We do not anticipate that the EU will repeal its adequacy decision on its own. However, this recent statement from Schrems and NOYB suggests that the Framework may be in for a challenge. European or UK companies that transfer data to those in the US, and those who receive such data in the US, should anticipate this. Practical steps to prepare include (1) taking stock of data that is flowing, (2) the basis on which the transfers are being made, and (3) assessing if additional protection measures should be put in place.