Open Joint Letter on a Public Reassessment of the EU-US Adequacy Decision

On 29 June, the US Supreme Court ruled that US President Trump can remove the leaders of independent agencies and commissions, overturning nearly 90 years of precedent limiting executive power. This decision raises serious questions about one of the key safeguards underpinning the EU-US Data Privacy Framework adopted in 2023: independent supervision.

Under this Framework, personal data can be transferred from the EU to certified US organisations without additional transfer safeguards, based on the European Commission’s finding that the United States ensures a level of protection for personal data that is essentially equivalent to that guaranteed under EU law. This is not only about data protection, but also about the rule of law. The Commission relied on the existence of independent institutions capable of enforcing data protection rules. When the independence of those institutions is called into question, the Commission must reassess whether the conditions for adequacy remain fulfilled.

Following the Supreme Court’s ruling in Trump vs. Slaughter, CDT Europe – together with 36 civil society organisations and academics – have written to Commissioner McGrath urging the Commission to immediately launch a public reassessment of the EU-US adequacy decision, consult civil society and independent experts, and publish its legal assessment of the implications of this judgment.

Adequacy is not a one-off political endorsement or diplomatic gesture. It is a living legal mechanism that must be revisited whenever the facts change. Under the GDPR, the European Commission is required to keep adequacy decisions under continuous review, assessing whether the legal and institutional framework of a third country continues to provide an adequate level of protection. This includes examining the rule of law, the availability of effective judicial remedies, and the independence of supervisory and enforcement authorities. Where those conditions materially change, the Commission has a legal obligation to reassess whether its adequacy finding remains justified and people in the EU continue to receive equivalent protection when their personal data leaves the Union.

Ignoring constitutional and institutional developments would weaken not only this adequacy decision, but confidence in the adequacy framework as a whole. The credibility of the GDPR depends on applying this principle consistently, regardless of the country concerned. At times of deregulation and geopolitical pressure, this is an opportunity for the EU to demonstrate that the GDPR is a living safeguard for fundamental rights, not a static political declaration.

Read the full letter here.