Civil society coalition urges EU to reassess US data-transfer adequacy after Supreme Court ruling

The groups want the Commission to publish its legal analysis, consult outside experts and determine whether US oversight bodies still meet the independence standard behind the 2023 EU-US Data Privacy Framework.

CDT Europe and 36 civil society organisations and academics have asked the European Commission to immediately begin a public reassessment of its decision allowing personal data to move from the European Union to certified US organisations under the EU-US Data Privacy Framework.

The request follows the US Supreme Court’s 29 June ruling in Trump v. Slaughter, which CDT Europe said permits President Trump to remove leaders of independent agencies and commissions. The coalition argues that the ruling raises questions about the independence of US institutions that supervise and enforce data-protection rules.

In a joint letter to Commissioner McGrath, the signatories asked the Commission to launch a public review of the EU-US adequacy decision, consult civil society and independent experts, and publish its legal assessment of the Supreme Court judgment’s implications.

The Commission adopted its adequacy decision for the United States in 2023. The decision allows EU personal data to be transferred to certified US organisations without additional transfer safeguards.

The arrangement rests on the Commission’s finding that the United States provides privacy protections that are essentially equivalent to those guaranteed under EU law. CDT Europe said that finding relied on the existence of independent institutions capable of enforcing data-protection rules.

The coalition’s argument is that a legal change affecting the removal protections of agency leaders could call that premise into question. Its letter frames the issue as both a data-protection and rule-of-law question, particularly where an adequacy finding depends on independent supervisory and enforcement institutions.

For compliance teams, the immediate legal position described in the letter has not changed: the EU-US Data Privacy Framework remains the basis identified by the Commission for transfers to certified US organisations without additional transfer safeguards. The letter calls for a review; it does not itself alter transfer obligations.

Under the General Data Protection Regulation, adequacy decisions are subject to continuous Commission review rather than being permanent approvals. CDT Europe said that review must assess whether a third country’s legal and institutional framework continues to provide an adequate level of protection, including whether independent institutions remain able to enforce data-protection rules.

The groups are not asking for an internal Commission check alone. They want a public process, consultation with civil society and independent experts, and publication of the Commission’s legal assessment of whether the Supreme Court decision affects the safeguards relied on in 2023.

The joint letter does not establish how the Commission will respond or whether it considers the Supreme Court ruling to change the United States’ adequacy status. But the signatories are seeking an immediate reassessment, placing renewed attention on the independence of the US institutions underpinning the framework.