A ruling that sounds like an administrative matter
On 29 June 2026, the US Supreme Court ruled that the President may remove the commissioners of the Federal Trade Commission (FTC) at any time. The FTC is the most important US authority enforcing data protection commitments made by US providers. What sounds like an American administrative matter also affects Swiss companies that process personal data in Microsoft 365, Google Workspace or AWS. This is because the independent FTC is one of the pillars of the Data Privacy Framework (DPF), on which data transfers to certified US providers rely today.
What the ruling is, in sober terms
Trump v. Slaughter (Docket 25-332) breaks with Humphrey's Executor of 1935, the precedent that underpinned the FTC's independence for over 90 years. The FTC is therefore no longer structurally independent but subject to presidential control.
Nothing has been revoked yet, however. The DPF continues to apply until the European Commission changes it or a court strikes it down. The General Court of the EU dismissed the Latombe action for annulment of the adequacy decision on 3 September 2025; the appeal before the Court of Justice of the European Union (C-703/25 P) is pending.
The two pillars: keeping supervision and legal redress apart
The EU adequacy decision of 10 July 2023 states that certified US companies offer an adequate level of data protection. Two of its load-bearing pillars are decisive here.
The first, independent enforcement of the self-commitments by the FTC, is directly weakened by the ruling. Art. 45 para. 2 lit. b GDPR explicitly names independent supervision as a criterion.
The second, legal redress for people from the EU before the Data Protection Review Court, is not directly affected by the ruling. It rests on Executive Order 14086, not on the FTC. This distinction is not a detail: anyone who conflates the two overstates the case and loses credibility in expert discussions.
The Swiss lever
The Swiss-U.S. DPF, in effect since 15 September 2024, has the same architecture and the same FTC component. Under Art. 16 of the Swiss Federal Act on Data Protection (FADP), personal data may be transferred to the USA if the Federal Council (the Swiss government) recognises the protection as adequate, as it has done for DPF-certified US companies, or if other safeguards such as standard data protection clauses apply. Because the Swiss-U.S. DPF rests on the same FTC component, the weakening also affects the Swiss recognition. Whether it stands is for the Federal Council to decide; it is laid down in the Data Protection Ordinance.
The foundation was weak even before
The ruling does not hit a strong structure. Safe Harbor (2015) and Privacy Shield (2020) already failed before the Court of Justice of the European Union because of US surveillance and the lack of legal redress for Europeans.
On 31 July 2026, the European Data Protection Board (EDPB) asked the European Commission in writing to examine the impact of Trump v. Slaughter on the adequacy decision. Experts are debating whether this will lead to a ‘Schrems III’ case. That is an assessment, not the state of proceedings.
What this means in practice: M365, AWS, SaaS
For transfers to DPF-certified US providers, the basis still applies today but is becoming more fragile. Law firms such as Faegre Drinker therefore recommend agreeing standard contractual clauses (SCCs) in addition to the DPF as a safeguard.
Three bases for access that exist independently of the DPF
This is the point that the DPF debate often obscures: the actual access risk does not depend on the adequacy decision at all. Three US legal bases operate independently of one another, and a valid DPF rules out none of them.
The CLOUD Act (2018) obliges US providers to hand over data to US authorities upon lawful order, regardless of where it is stored. A data centre in Zurich offers no protection if the provider is subject to US law, like Microsoft, Google or AWS.
FISA Section 702 permits the targeted surveillance of non-US persons via US communications providers. It is precisely this basis that drives the dispute over adequacy. Its statutory basis expired on 12 June 2026, but according to reports, the certifications approved by the competent US court will continue to support the surveillance until around March 2027.
Executive Order 12333 permits foreign intelligence gathering outside the FISA framework, without judicial approval. Since 2022, EO 14086 has also made these activities subject to principles of necessity and proportionality and opened the way to the Data Protection Review Court. However, this too is an order of the President, not a law.
The three must be considered together. Their common consequence: even a watertight DPF does not protect against lawful US access to plaintext. The transfer question and the access question are two different things, and the second remains even if the first is resolved.
Our approach: keys outside the cloud
The robust answer lies not in readjusting contracts, but one level deeper: in the data itself. It is not the storage location that determines the risk, but who can access readable data.
Data-centric, format-preserving encryption turns the question around. Anyone who protects their data themselves and keeps the keys discloses only unreadable ciphertext for the protected fields in the event of access. Swiss law supports this approach: under the relative method, what counts is whether a recipient can identify the data subjects (Swiss Federal Supreme Court, BGE 136 II 508). A cloud provider without keys cannot do so if all details that point to the person are encrypted. For the protected data, a company thus becomes largely independent of the adequacy question: the data remains protected even if a transfer mechanism falls.
Prewen implements this with OpenText SecureData. Sensitive fields are protected in a format-preserving way, and processes and analyses generally continue to work. The root material stays in the environment in which SecureData is operated and is not handed over to the service whose data is being protected. If we operate SecureData for you, this environment is located in Switzerland. More on data-centric security · Demo
And what about AI?
A related idea, with a different method, applies to prompts to AI services such as ChatGPT or Claude, which Praevana works with. These services, too, are backed by US providers, and AI models in Swiss or European data centres of Microsoft, AWS or Google do not change the fact that the CLOUD Act targets the provider, not the location.
In protected mode, Praevana replaces recognised identifying details such as names, addresses and identification numbers with placeholders before a prompt goes to the language model. How SecureData and Praevana complement each other is shown on the Security for AI page.
Recommended action
Short term: review standard contractual clauses as an additional safeguard. Structurally: protect the most sensitive data yourself, so that the next transfer debate no longer determines your own risk. Arrange a meeting
Questions on this topic? We look forward to talking with you.
Get in touch