The US Supreme Court has decided that the US President can exercise direct influence over the Federal Trade Commission (FTC). This means the data protection agreement between the EU and the US loses its crucial foundation. It is only a matter of time before the European Court of Justice must confirm this. Data protection activist Max Schrems has already announced a corresponding lawsuit. Companies that continue to use US services for data processing must prepare for renewed uncertainty.

On June 29, 2026, the US Supreme Court ruled that the US President can dismiss members of the Federal Trade Commission (FTC) at any time without giving reasons. This overturned over 90 years of legal precedent (Humphrey's Executor from 1935), which protected the FTC as an independent agency from arbitrary dismissal. The case was triggered when US President Trump dismissed FTC Commissioner Rebecca Slaughter at the beginning of his second term in 2025 without providing the legally required justification. The ruling has far-reaching impacts on transatlantic data traffic and data protection in the EU. This is because the entire EU-US data agreement relies on the FTC as an independent supervisory authority.

The currently valid legal basis for transferring personal data from the EU to the US is the EU-US Data Privacy Framework from 2023 and the associated adequacy decision from the EU Commission. The FTC plays an essential role here, as it acts as an independent supervisory authority in the US to monitor and enforce compliance with data protection obligations by US companies. In the adequacy decision (Implementing Decision (EU) 2023/1795), the EU Commission repeatedly references this independence of the FTC. The EU Commission references this independence no fewer than 259 times in its own adequacy decision.

EU treaty law requires that data protection oversight be conducted by an independent body. This requirement is specifically anchored in Article 16 of the TFEU and Article 8(3) of the EU Charter of Fundamental Rights. Third countries must also meet this requirement to ensure an equivalent level of data protection. With the Supreme Court's ruling, the FTC loses its independence, and therefore the EU-US Data Privacy Framework lacks a legal foundation.

Austrian data protection activist Max Schrems has already brought down the two predecessor agreements: "Safe Harbor" (Schrems I) and later "Privacy Shield" (Schrems II) were both declared invalid by the ECJ.

Schrems is now calling on the EU Commission to revoke the adequacy decision for the US, since there are no longer independent authorities in the US. His organization noyb informed the Commission in a letter on June 30, 2026, that no other US authority could remedy this deficit. At the same time, noyb is preparing a lawsuit to give the ECJ the opportunity to declare the current EU-US Data Privacy Framework null and void.

Even if the basis of the EU decision has expired, the adequacy decision remains formally valid until it is revoked by the EU Commission or declared invalid by the ECJ – so legally nothing changes in the short term. This process can take two to three years. In the long term, however, it is to be expected that the EU-US Data Privacy Framework will cease to serve as a legal basis for transferring personal data to the US.

EU companies that have outsourced the processing of personal data to US cloud providers or rely on the EU-US Data Privacy Framework as a legal basis for transferring personal data to the US should review their transfer mechanisms in the future. A court revocation of the agreement has become significantly more likely. Alternative instruments such as Standard Contractual Clauses (SCCs) or Binding Corporate Rules (BCRs) are gaining importance again, but their legal certainty is also questionable as long as a similar level of data protection can no longer be guaranteed in the US.

UPONU demonstrates with the infra:u Cloud Stack what a true alternative to US hyperscalers can look like. Our entire cloud infrastructure is operated exclusively in Germany. Servers, data centers, and support are subject entirely to German and European law. No transfer of personal data to the US takes place. Neither the EU-US Data Privacy Framework nor its possible annulment plays a role, therefore.

The infra:u Cloud Stack is sovereign "by design." Based on OpenStack architecture according to the Sovereign Cloud Standard (SCS), there is simply no data exchange with third countries. It is advisable to critically review services still operated in the US right now and, in perspective, to bring them under one's own sovereignty – in other words, to consistently switch to European alternatives. Because as long as the EU Commission has not made a formal decision, the current situation remains legally uncertain, and no one knows what sanctions or measures will be imposed against the EU next. Only those who switch now will create lasting legal certainty instead of being surprised by the next political development. UPONU offers a solution that will endure regardless of how the legal situation in the US develops further.