🔴 The Expected Invalidation of the EU-US Data Privacy Framework

Research note: a strategic brief for members 

Dear members,

The European Union is about to see its framework for data transfers with the United States called into question. After the invalidations of Safe Harbor (2015) and Privacy Shield (2020), the Data Privacy Framework (DPF) is now in the hot seat.

By removing the Democratic members of the Privacy and Civil Liberties Oversight Board (PCLOB) and casting doubt on American commitments on surveillance, the Trump administration has dealt a major blow to the DPF's credibility. Without the PCLOB, the legal foundation of the DPF no longer holds, and an invalidation by the Court of Justice of the European Union (CJEU) looks increasingly likely.

But beyond the DPF, it is the entire European framework for data regulation that is under pressure. The Trump administration, aligned with the big American tech platforms, is trying to weaken European regulations such as the Digital Markets Act (DMA), the Digital Services Act (DSA) and the AI Act. An offensive against the rigidity of the GDPR could follow, with pressure to limit its exceptions and clear the way for a framework friendlier to American companies.

Executive summary

The DPF, adopted in July 2023, allows data transfers that comply with European requirements. However, two recent decisions by the Trump administration threaten its future:

1. The removal of the PCLOB's Democratic members, which leaves the body unable to function and eliminates a key safeguard against American surveillance.
2. An executive order calling for a reassessment of national security commitments, which could lead to an official withdrawal of the United States from the DPF.

The invalidation of the DPF by the CJEU, or its voluntary withdrawal by the European Commission, are now likely scenarios.

This note examines: