The Watchdog Answers to the President Now

Pillar 02 · Legal

What Trump v. Slaughter changes for transatlantic data transfers — and why the answer was never a better promise.

On 29 June 2026, in Trump v. Slaughter, the US Supreme Court held that the for-cause protection shielding FTC commissioners from dismissal is unconstitutional.

Six to three. Roberts writing. Humphrey's Executor overruled outright — and if anything more was left of it, the Court overruled that too.

In plainer terms: the President may now remove FTC commissioners more or less at pleasure.

Most of the coverage is about presidential power. Reasonably so. But for anyone moving European data across the Atlantic, the point is narrower, quieter, and does not fade with the news cycle.

The United States has just made Europe's favourite transfer reassurance materially harder to believe.

The argument you no longer have to make

Article 8(3) of the Charter, read with Article 45 GDPR, makes independent supervision non-negotiable.

For the commercial strand of the Data Privacy Framework, the Commission leaned on FTC enforcement as part of that supervisory machinery. The reliance now has a problem wearing a robe.

The highest court in the United States has explained, at length and in writing, why the FTC cannot be insulated from presidential control.

That is the part worth sitting with.

The objection to the DPF used to take work. Proportionality, essential equivalence, surveillance law, redress, classified access, executive orders — a wall of argument built to exhaust the challenger before the merits.

This one is shorter.

The next challenger attaches the judgment and asks the Court of Justice why Europe should keep treating executive-controlled enforcement as independent in substance.

And it does not stop neatly at the commercial principles.

The redress and oversight side leans on institutions whose independence now looks less settled than the Commission assumed. The PCLOB is one. When three of its members were removed in early 2025, the reassurance was that a court had put them back. Slaughter does not decide that litigation. It pulls on the same thread — whether any US oversight body can be insulated from presidential control at all.

That is the awkward part. The independence the framework was sold on is no longer theoretical to question. It is in the plumbing.

What this is, and what it is not

This is not the end of the DPF.

Adequacy decisions do not collapse on the strength of a sharp argument. They stand until annulled, repealed, or replaced.

Latombe was dismissed by the General Court in September 2025 and is now on appeal. The Court assessed the framework against the law and facts as they stood at the 2023 adequacy decision — which is itself one of the contested questions, because the ground has moved since.

So the honest verb is not "dead."

It is "wobbling, in writing, with a citation."

What changed is the posture of the next case. That is the thing the Commission cannot draft its way around.

The fallback inherits the disease

Every advisory now ends the same way: keep your Standard Contractual Clauses ready.

Keep them. But they are not an escape hatch.

Since Schrems II, SCCs carry a transfer impact assessment. That assessment runs straight back into the same surveillance findings, the same executive-order machinery, and now an oversight environment the United States has itself confirmed is more executive-controlled than Europe would like.

So look at the whole stack. Adequacy. SCCs. Binding Corporate Rules.

Every mechanism is a promise. A certification, a clause, an executive order, a governance story with a PDF attached.

The buyer's real choice was never strong framework versus weak framework.

It is three flavours of promise, or something else.

Sovereignty by architecture, not by promise

This is the thesis I keep stating and would gladly retire one day:

Data residency is not data sovereignty.

A Canadian region of someone else's cloud is residency. A European region is residency. A "sovereign cloud" run under someone else's ultimate legal control is residency with better stationery.

The data may sit locally. The operator does not.

And if the operator is reachable by a legal system whose checks just got weaker, the location of the disk is not the story. It is the opening slide.

The durable answer is not a better promise. It is removing the thing that can be compelled.

SkyeConnex is built for that. Its engine, Raidr.cloud, erasure-codes data into shares — RS(5,2) — and distributes them across separate providers and jurisdictions under zero-knowledge controls. No single location holds anything reconstructable. No single provider sees the whole file. No single operator holds enough shares, keys, metadata, or control-plane authority to quietly rebuild access.

That last sentence is the one that matters.

The claim is not that court orders disappear. They are very real, and they arrive with stamps and deadlines.

The claim is that what any single compelled party can produce should be mathematically useless until enough separately controlled shares and keys are brought together — and no single order reaches that far.

That is what "nothing useful to compel" means. Not a clause. Not a comfort letter. A property of the architecture. It does not get reissued when an administration changes, because there is no issuing authority to change its mind.

The door and the room

Let me be precise, because the people who should read this — DPAs, government CISOs, privacy counsel, anyone signing off on a Protected B workload — will catch a salesman who overreaches.

Slaughter does not make the architecture true. It opens a door. It forces the residency-versus-sovereignty distinction onto the table, with the United States as the witness.

The architecture still has to survive scrutiny, and it should. Keys, shards, metadata, audit, control plane, operator access, reconstruction thresholds, emergency access, support flows — all of it gets tested. If the design quietly hands one party enough to reassemble the data, the sovereignty is decorative.

But built properly, sovereignty stops being a promise the operator makes and becomes a constraint the architecture imposes.

That is the room you walk into once you stop renting the land.

Bias declaration: I am the founder and architect of SkyeConnex, the sovereignty service powered by our Raidr.cloud engine. I have a commercial interest in the conclusion. I have argued it on mechanism rather than brochure. The citations are public, the reasoning is there to be challenged, and the math should be tested, not admired from across the room.

Sources worth linking in the comments: major reporting on Trump v. Slaughter*; Commission Implementing Decision 2023/1795 for the DPF; the General Court's September 2025* Latombe judgment (T-553/23); and the PCLOB removal and reinstatement record.