The European Data Protection Supervisor (EDPS) wrote a letter to the European Commission on the US Supreme Court judgment Trump v. Slaughter. The Supervisor aks the Commission to closely assess whether this development affects the adequacy decision underpinning the EU-US Data Privacy Framework.

The EDPS wrote:

The EDPB wishes to highlight that the existence and effective functioning of one or more independent supervisory authorities in the third country, with responsibility for ensuring and enforcing compliance with the data protection rules, is one of the key elements to be taken into account when assessing the adequacy of the level of protection in a third country according to Article 45(2)(b) of Regulation (EU) 2016/679. It is also considered one of the key elements to ensure that data subjects in the EEA are guaranteed an essentially equivalent level of data protection in practice, and to ensure cooperation with the supervisory authorities of the Member States.

The EDPB respectfully notes that the European Commission, in the adequacy decision underpinning the EU-US Data Privacy Framework (‘DPF’) [4] , explicitly refers to the independence of the US authorities, including the FTC and that its five Commissioners may only be removed by the President for inefficiency, neglect of duty, or malfeasance in office [5] . Given the potential consequences that the US Supreme Court’s judgment may have in the EEA and its considerable significance for the EDPB, the EDPB asks the European Commission to closely assess whether this development affects the functioning of Commission Implementing Decision EU 2023/1795 and would welcome relevant actions, including the continued sharing of information with the EDPB in a timely manner.

 

[4] Commission Implementing Decision EU 2023/1795, available at https://eur-lex.europa.eu/legalcontent/EN/TXT/PDF/?uri=CELEX:32023D1795

[5] Commission Implementing Decision EU 2023/1795, §58 – 60.