image generated using AI

Risks and Opportunities for EU Businesses: The Referee is fired, and Europe’s Data Privacy Departments Just Woke Up -or not?

TL;DR: the referee got fired, the game didn’t stop, and somebody in Europe is quietly measuring your market share. If you’d rather that somebody were you — or you’d just like a second opinion before your compliance team finds out the hard way — you know where to find me.

A Supreme Court opinion about firing a Federal Trade Commissioner just quietly rearranged the seating chart of the entire transatlantic cloud business. Nobody in Brussels saw it coming from that angle. Then again, nobody ever does — GDPR’s biggest plot twists always arrive disguised as “boring” American administrative law or court decisions.

The plot, for anyone who was on holiday

On June 29, 2026, the U.S. Supreme Court ruled 6–3 in Trump v. Slaughter that the President can fire FTC Commissioners whenever he feels like it — no “for cause,” no committee hearing, no awkward goodbye email required. In the process, the Court threw out Humphrey’s Executor, a precedent that had quietly kept independent U.S. agencies independent for roughly 90 years. Three dissenting Justices warned this hands the presidency more removal power than “the English Crown” ever had, which is either a great historical footnote or the setup for a very dry joke at a compliance conference — possibly both.

Why should a European privacy lawyer care about American agency gossip?

Because the entire EU-U.S. Data Privacy Framework — the paperwork that lets American companies legally process European personal data — was built on the idea that U.S. oversight bodies, FTC included, are independent. That assumption just took a direct hit. The European Data Protection Board has already asked Brussels to review the Framework. Max Schrems, Europe’s most reliable producer of sequels (Safe Harbor, RIP; Privacy Shield, RIP), is reportedly warming up for the next round. If the CJEU has a type, this is it.

The part that actually costs money

Here’s the unglamorous bit every general counsel in US and in Europe needs to hear at least once before their next board meeting: if this Framework genuinely wobbles, routing European personal data through a U.S. provider becomes a real legal risk and therefore a financial risk, too. Crucially, hiding behind a European subsidiary or European servers doesn’t fix it. The problem was never geography. It’s about who can be forced to hand the data over, and whether anyone independent is watching when that happens. A German works council smelling that kind of risk will not be charmed by a nice Dublin or Frankfurt data center; works councils have a talent for finding the lowest-risk option and insisting on it, loudly, in writing, with a meeting invite attached.

Meanwhile, in Europe: the opportunity nobody RSVP’d to

Every regulatory earthquake creates a gap in the market, and this one is roomier than most! European cloud, hosting, and AI infrastructure providers — the ones who’ve spent years pitching “digital sovereignty” to slightly bored procurement teams — suddenly have the best sales pitch of their careers, and they didn’t even have to write it themselves. The U.S. Supreme Court wrote it for them. If a company can’t credibly promise independent oversight of U.S.-owned infrastructure, a genuinely independent European operator running the same software under license starts looking less like a nice-to-have and more like the boring, sensible choice. Boring and sensible, it turns out, is a great business model when the alternative is an administrative fine or a court case with your name on it. But much more severly: have the processing banned, see Art. 58 section 2 lit. f GDPR, or have the data flow to US-services suspended, see Art. 58 section 2 lit. j GDPR.

The bit that’s a little uncomfortable to say out loud

Let’s not pretend this is only a compliance story. Handing one person the unchecked power to remove the officials meant to check him is, by design, a fairly serious dent in the separation of powers — and that’s true whether it happens in Washington or anywhere else. A country is of course free to run its institutions however it likes. Whether concentrating that much power in one office tends to end well over the long run is, let’s say, a question with a fairly well-documented answer during the last 2000+ years. Whether the U.S. self-corrects from here is genuinely not ours to predict. What we do know is that overturning a 90-year-old precedent is not a subtle signal, and the current administration seems entirely willing to use the tool it was just handed. Future administrations? Open question, and probably a good subject for a very different kind of article.

And this isn’t theoretical throat-clearing — the firing already happened. Slaughter and fellow Democrat Alvaro Bedoya were shown the door back in March 2025; the Supreme Court just spent over a year confirming, that the President was allowed that to do. Since then a third Republican Commissioner, Melissa Holyoak, has also left for a U.S. Attorney job, leaving the FTC running on precisely two Commissioners — both Republican, with three of five seats sitting empty. A White House aide, Ryan Baasch, was floated to fill one of them, then quietly un-floated in January 2026 and kept in the West Wing instead. One former FTC Chair has openly speculated the administration may simply leave the seats empty indefinitely — an agency with no one left to disagree needs no new Senate hearings to keep it that way. If and when someone does get appointed, place your bets accordingly.

So, what do you actually do about it from am European Perspective

Two practical directions are on the table. One: license the technology, but let a genuinely independent European operator — no ownership strings attached to the U.S. side — run it on the ground in Europe. Promising, not automatic; get it checked properly before you put it in a slide deck.

Two, and this one is delightfully nerdy: the U.S. has never had a single federal privacy law — each of the 50 states writes its own, or doesn’t bother. That patchwork, usually a compliance headache, opens an odd door: the European Commission could in theory grant an adequacy decision to one individual U.S. state, the same one-sided mechanism it already uses for other countries. States can’t sign a treaty with the EU themselves — the U.S. Constitution’s Compact Clause (Article I, Section 10) forbids agreements with a “foreign Power” without Congress’s blessing, and Congress signing off on that is not a bet anyone should make. But an adequacy decision isn’t a treaty; it’s Brussels deciding unilaterally, the same way it already decided about Japan, the UK, or Argentina.

Which state would even qualify? Almost certainly not most of them. Nineteen U.S. states now have comprehensive consumer privacy laws on the books — Colorado, Connecticut, Virginia, Texas, Utah, Oregon and a growing list of others — and in every single one of them, enforcement sits with the state Attorney General’s office: a political appointee, not a dedicated regulator. California is the outlier, and the only one, having built the California Privacy Protection Agency (CPPA) — a standalone, independent authority that looks, on an org chart, more like a European data protection authority than anything else the U.S. has produced at any level of government. That’s not a coincidence; it’s precisely the feature an EU adequacy review would go looking for. Nobody has actually tried this yet, and turning “California, but make it GDPR-adequate” into an actual EU legal instrument could take years — but as far as party tricks go, it’s a genuinely good one. And you never know — the EU Commission can be surprisingly fast-paced when it wants to be.

A quick word for the U.S. providers in the room

If you’re an American cloud, software or AI vendor reading this over your coffee and quietly hoping it blows over: it probably won’t, and hope is not a compliance strategy.

The credible move is to stop marketing “trust us” and start building structures that don’t require anyone to. That means genuine operational independence for your European entities — not a logo change and a Dublin or Frankfurt mailing address, but real technical and organizational separation: encryption keys held in Europe that your U.S. parent cannot reach, a genuinely autonomous EU management chain, and public, auditable limits on what you will hand over in response to a U.S. government request absent a valid legal basis under a mutual legal assistance treaty.

Some of this groundwork already exists — Microsoft’s EU Data Boundary, AWS’s European Sovereign Cloud, Google’s sovereign offerings built with local partners — and the direction of travel is clear even while the fine print is still being fought over. None of it will feel like a fun capital allocation decision in a quarter where the market wants growth, not governance. But the providers who get ahead of this now keep their European revenue; the ones who wait for the CJEU to explain it to them in a judgment will not enjoy the read — and Article 58 GDPR gives the regulators sending that judgment some genuinely sharp tools to enforce it with.

None of this is resolved. All of it is worth a slide in your next risk committee deck — ideally before the CJEU turns it into a headline for you.

Written with a straight face about a genuinely unfunny topic. Not legal advice — for that, hire someone who bills by the hour and doesn’t do puns, or find someone who’s spent more years than their LinkedIn profile lets on helping U.S. companies survive European data protection law — and European companies make sense of U.S. court drama. Written by AI, checked by human.