Status Check: Support Is Quickly Eroding For The EU-U.S. Data Privacy Framework

Takeaways

• Increased federal deregulation and related actions are further destabilizing the already tenuous foundation of the Data Privacy Framework (DPF). European privacy regulators have been issuing guidance indicating that they expect a European pull-back from the DPF.
• Businesses that rely on the DPF should maintain their certification, but should move now to prepare to activate alternative data transfer mechanisms, such as the standard contractual clauses, and update lapsed transfer and data privacy impact assessments.
• Review current cloud-storage arrangements and consider regionalizing European data storage to avoid EU-to-U.S. data transfers, especially if your cloud provider is relying on DPF certification to legitimize GDPR data transfers.

After years of litigation, false starts, and invalidated frameworks, the U.S. had finally achieved a simplified path for GDPR compliant transfers of personal data from Europe. However, European reaction to the recent changes on the U.S. side of the pond indicates a wavering in the support of the EU-U.S. Data Privacy Framework (DPF) and threatens to send the U.S. back into the data transfer dark ages.

Overview

In July 2023, the European Commission adopted its adequacy decision allowing for easier personal data transfers between the European Union and the United States, with the U.K. Government and Swiss Federal Administration quickly following suit. To participate, U.S. companies must be properly certified and comply with the DPF's principles.

Maintaining certification under the DPF is not easy, but the DPF allowed disclosing European-based companies something akin to a safe harbor that prevented local regulators from peaking over their shoulders and nit-picking transfer impact assessments, while the receiving U.S.-based companies wouldn't have the specter of being dragged into European courts to address data privacy complaints. DPF is a collective "win-win," and more than 2,800 U.S. companies currently participate in the DPF.

But the DPF's foundation was built upon the legal equivalent of sand: the executive order. Executive Order 14086 on "Enhancing Safeguards for United States Signals Intelligence Activities" established additional oversight on intelligence data collection and a mechanism to allow EU data subjects to seek redress in the U.S., both key sticking points with the CJEU's strike down of the previous data transfer frameworks. However, even at the time, many European watchdogs and privacy advocates said the U.S.'s efforts to resolve its data protection issues were a paper tiger and that a challenge was inevitable and invalidation likely.

While the current second Trump Administration has not revoked E.O. 14086 outright, U.S. President Trump removed three of the five members of the U.S. Privacy & Civil Liberties Oversight Board (the "Board"). The European Commission's 2023 DPF adequacy decision placed special importance on the role of the Board in ensuring that U.S. intelligence practices lived up to the DPF's standards. The Board is also responsible for overseeing the newly established Data Protection Review Court, which provides a redress mechanism for European citizens challenging unlawful surveillance in the U.S. The firings halt the Board's work indefinitely since only one member remains. Without a quorum, the Board cannot conduct its oversight of the DPF, including its annual review of the remedies addressing privacy and intelligence complaints.

Further, the new Executive Order 14215, "Ensuring Accountability for All Agencies," requires all federal agencies, including the Federal Trade Commission (FTC), to submit significant regulatory actions for presidential review before publication in the Federal Register. E.O. 14215 sharply questions whether the FTC will be sufficiently independent to enforce the DPF in accordance with GDPR Article 45(2)(b).

There have been no official actions or changes yet. However, data points are signaling a shift against the ongoing viability of the DPF:

• Initial reaction from Europe was cautious, with European Commissioner Michael McGrath committing to fully enforcing and implementing the Data Privacy Framework.¹ However, McGrath's comments came before the escalating trade war between the U.S. and Europe and the general souring of Europe's cooperative attitude toward the U.S.
• In April 2024, FISA Section 702, a major complaint of European privacy regulators, was reauthorized with an expanded scope for an additional two years.²
• In late 2024, the European Data Protection Board adopted a report that highlighted issues with the EU-U.S. Privacy Framework and called on the European Commission to reevaluate the DPF adequacy decision within the next three years.³
• Privacy advocate Max Schrems, chief architect of the efforts that invalidated the previous two U.S. data transfer frameworks, has publicly stated that he believes the second Trump Administration's actions themselves could invalidate the DPF, making a formal legal challenge unnecessary.⁴
• In February 2025, Norway's Data Protection Authority (Datatilsynet) advised European businesses to implement "exit strategy[ies]" in light of an inevitable challenge to the DPF.⁵ Denmark's Ministry for Resilience and Preparedness⁶ and Germany's Federal Ministry of the Interior⁷ have issued similar warnings.
• A group of technology lobbyists has formally petitioned the European Commission to take action to reduce the EU's reliance on U.S. digital services and infrastructure "in light of the stark geopolitical reality Europe is now facing."⁸
• The Swedish Data Protection Authority has publicly disclosed concerns about the reliability of the DPF adequacy decision in light of the dismantling of the U.S. Privacy & Civil Liberties Oversight Board.⁹
• The Belgian Data Protection Authority has recently held that data transfers under the U.S. Foreign Account Tax Compliance Act breach EU privacy rights due to the IRS's use of tax data for immigration purposes.¹⁰

Footnotes

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.