The EU-US Data Privacy Framework: valid, and contested

The Commission adopted an adequacy decision for the EU-US Data Privacy Framework, and that decision remains in force. Organisations transferring personal data to certified US recipients under it are doing so lawfully, and that has not changed.

Philippe Latombe, a French member of parliament, brought an action for annulment. The General Court dismissed it on 3 September 2025, upholding the decision. He appealed on 31 October 2025, and the appeal is registered at the Court of Justice as Case C-703/25 P. No hearing date has been set.

That is the whole legal position as it stands. Anyone describing the framework as invalid is ahead of the record, and anyone describing it as settled is behind it.

On 29 June 2026 the US Supreme Court decided Trump v. Slaughter, overruling Humphrey's Executor. That earlier case had confirmed that statutory protections enacted by Congress for Federal Trade Commission commissioners did not violate the separation of powers, so commissioners could be removed only for specified causes such as inefficiency, neglect of duty or malfeasance in office.

The Court held that the FTC has accumulated vast rulemaking, enforcement and adjudicatory powers, that it unquestionably exercises executive power, and that it must therefore be controlled by the Chief Executive.

The relevance to European transfers is indirect but structural. Enforcement of the framework's commercial principles sits with the FTC, and the independence of that enforcement was part of what the Commission weighed when it assessed adequacy. A change to the independence is a change to an input of the assessment, which is why the European Data Protection Board wrote to the Commission about it rather than treating it as US domestic news.

The FTC has accumulated vast rulemaking, enforcement and adjudicatory powers, and it unquestionably exercises executive power, and must therefore be controlled by the Chief Executive, in whom such power is vested.

Not panic, and not ignore it. The framework is lawful today, so ripping out a working arrangement on the strength of a pending appeal is a cost with no present benefit.

What is proportionate is to know your exposure and to make it reversible. Know which of your processors rely on the framework rather than on standard contractual clauses or on staying inside the EU. Know what a migration would cost and how long it would take, mapped rather than estimated. And write both down, because the value of the exercise is having done it before the news rather than after.

For new procurement the calculation is different, since the cost of choosing an arrangement that does not depend on the mechanism is usually small at selection time and large at migration time. That asymmetry, rather than any prediction about the appeal, is the argument.

The transfer question only matters in proportion to how much is being transferred and how sensitive it is, so it is worth grounding in the incident record rather than in argument.

The ENISA Threat Landscape 2025 curated 4875 European events over the year to June 2025. Public administration was the most targeted sector at 38.2 percent, followed by transport at 7.5, digital infrastructure at 4.8, finance at 4.5 and manufacturing at 2.9. Essential entities under NIS2 accounted for 53.7 percent of recorded incidents.

The relevance is straightforward. The sectors most exposed to incidents are also the ones under the strictest supervisory regimes, which means the same organisations face both the highest volume of security telemetry and the most detailed questions about where it goes.

A marketing platform that becomes unlawful to use can be switched off while a replacement is found. A detection platform cannot: switching it off means being blind during the migration, and migrating it means moving historical telemetry that the retention requirements say you must keep.

That makes reversibility a design property rather than a contractual one. The question is not only whether you could leave but whether you could leave without a gap in coverage, and the answer depends on whether data is exportable in a usable form.

It is the same question DORA asks financial entities to answer in their exit plans, and it is a reasonable question for anyone else to borrow.