What's Happening?
Following the U.S. Supreme Court's ruling in *President Trump v. Slaughter*, which found that a statutory protection limiting the President's ability to remove Federal Trade Commission (FTC) commissioners was unconstitutional, concerns have arisen regarding
the independence of the FTC. This ruling means FTC commissioners are now removable by the President at will, potentially impacting the EU-U.S. Data Privacy Framework (DPF). The European Commission's DPF adequacy decision had explicitly cited the statutory protection against removal as a basis for the FTC's independence. Bret Cohen, Partner, Privacy and Cybersecurity Practice at Hogan Lovells, and Julian Flamant, Senior Associate, Data, Privacy & Cybersecurity at Hogan Lovells Cadwalader, suggest that U.S. state attorneys general could provide an additional layer of institutional assurance for the DPF's long-term durability. They argue that state attorneys general possess consumer protection powers similar to the FTC, have developed considerable privacy enforcement experience, and operate independently of the federal executive.
Why It's Important?
The *President Trump v. Slaughter* ruling has significant implications for the stability and perceived independence of U.S. regulatory bodies, particularly the FTC, which is a principal commercial enforcement authority under the DPF. The European Data Protection Board has already requested an assessment of how this judgment affects the FTC's ability to uphold DPF commitments, and some, like Max Schrems, argue it undermines a central element of the adequacy decision. The proposal to involve state attorneys general is crucial because it offers a potential solution to maintain the DPF's integrity by leveraging existing, independent enforcement structures. This could prevent a disruption in transatlantic data flows, which are vital for numerous U.S. businesses and the broader economy. Without robust and independent enforcement, the DPF could be challenged, leading to uncertainty and increased compliance burdens for companies transferring data between the EU and the U.S.
What's Next?
The European Commission will likely assess the impact of the *President Trump v. Slaughter* ruling on the FTC's independence and its implications for the DPF. Discussions may ensue between U.S. and EU authorities regarding potential measures to reinforce the DPF's institutional safeguards. The proposal to involve state attorneys general could be explored, potentially leading to a model where qualified state attorneys general voluntarily participate as supplemental DPF supervisors. This would require establishing minimum criteria for participation, assessing their statutory powers and enforcement capabilities, and developing mechanisms for referrals and coordination. The outcome of these discussions will determine whether the DPF can maintain its adequacy decision and continue to facilitate transatlantic data transfers without significant legal challenges.
Beyond the Headlines
This development highlights a fundamental tension between executive power and regulatory independence, with broad implications for U.S. governance and international agreements. The reliance on state attorneys general to bolster a federal framework like the DPF underscores the unique nature of U.S. federalism, where state-level authorities can provide checks and balances. While this approach could offer resilience, it also introduces complexities due to variations in state laws, resources, and enforcement priorities. The debate also brings to the forefront the ongoing global scrutiny of data privacy regulations and the need for robust, independent oversight to ensure compliance. The long-term impact could be a more decentralized and potentially more resilient, albeit complex, system for data privacy enforcement in the U.S., influencing how other international data transfer mechanisms are structured.
