When the facts change, adequacy must be reviewed - European Digital Rights (EDRi)

Skip to content

Close

Search

How would you best describe that thing you're looking for?

Your search term

Close

About us

Vision and Mission

Team

Network

Board

Victories

Funding

Annual reports

What we do

Our work

Our topics

Media relations

Publications

Decolonising digital rights

Document Pools

Take action

Donate

EDRi Manifesto for digital futures

EDRi-gram newsletter

Campaigns

Events

Jobs

When the facts change, adequacy must be reviewed

Following the Supreme Court's ruling in Trump v. Slaughter, EDRi and other 36 civil society organisations and academics have urged the European Commission to immediately reassess the EU-US adequacy decision. The ruling undermines one of the safeguards on which the Commission relied when concluding that personal data transferred to the United States receives an adequate level of protection.

By EDRi · July 14, 2026

Adequacy is a living mechanism and it should be treated as such

On 29 June, the US Supreme Court ruled that US President Trump can remove the leaders of independent agencies and commissions, overturning nearly 90 years of precedent limiting executive power. This decision raises serious questions about one of the key safeguards underpinning the EU-US Data Privacy Framework adopted in 2023: independent supervisory.

Under this Framework, personal data can be transferred from the EU to certified US organisations without additional transfer safeguards, based on the European Commission’s finding that the United States ensures a level of protection for personal data that is essentially equivalent to that guaranteed under EU law. This is not only about data protection, but also about the rule of law. The Commission relied on the existence of independent institutions capable of enforcing data protection rules. When the independence of those institutions is called into question, the Commission must reassess whether the conditions for adequacy remain fulfilled.

Adequacy is not a one-off political endorsement , a diplomatic gesture or a political endorsement. It is a living legal mechanism, a legal finding that must be revisited whenever the facts change. Under the GDPR, the European Commission is required to keep adequacy decisions under continuous review, assessing whether the legal and institutional framework of a third country continues to provide an adequate level of protection. This includes examining the rule of law, the availability of effective judicial remedies, and the independence of supervisory and enforcement authorities. Where those conditions materially change, the Commission has a legal obligation to reassess whether its adequacy finding remains justified.

Following the Supreme Court’s ruling in Trump vs. Slaughter, we—together with 36 civil society organisations and academics—have written to Commissioner McGrath urging the Commission to immediately launch a public reassessment of the EU-US adequacy decision , consult civil society and independent experts, and publish its legal assessment of the implications of this judgment.

If the conditions change, the assessment must change too. Whenever legal or institutional developments affect the safeguards on which an adequacy decision is based, the Commission must assess whether people in the EU continue to receive equivalent protection when their personal data leaves the Union. Ignoring constitutional and institutional developments would weaken not only this adequacy decision, but confidence in the adequacy framework as a whole. The credibility of the GDPR depends on applying this principle consistently , regardless of the country concerned.

This is not about treating the United States differently. The same principle applies to every adequacy decision , as our previous work has shown. If the legal or institutional conditions on which adequacy was based materially change, the Commission has a duty to reassess its findings.

At times of deregulation and geopolitical pressure, this is an opportunity for the EU to demonstrate that the GDPR is a living safeguard for fundamental rights, not a static political declaration.