EU-US Data Privacy Framework (Adequacy Decision)
The EU-US Data Privacy Framework (DPF) is the European Commission adequacy decision in force since July 2023 that permits data transfers to certified US companies without extra safeguards such as standard contractual clauses; it succeeded the Privacy Shield, struck down by the CJEU in Schrems II in 2020. A central element is a redress mechanism for EU citizens, in particular the "Data Protection Review Court" (DPRC), whose independence from US executive agencies was a precondition for EU recognition. A first action for annulment against the decision was dismissed by the General Court of the European Union on 3 September 2025 (T-553/23, Latombe v Commission); an appeal against that judgment is pending before the Court of Justice (C-703/25 P). The US Supreme Court ruling in "Trump v. Slaughter" (late June 2026), which strengthened the president's power to remove members of independent US agencies such as the FTC at will, has raised new and serious doubts among specialists about the stability of those independence guarantees – positions range from noyb's call for the agreement to be withdrawn immediately to assessments (from the IAPP among others) that the redress mechanism does not lapse automatically in legal terms. For context: as of July 2026 the DPF therefore remains formally in force, but it is not uncontested – following further developments closely is strongly advised.