US supreme court invalidates EU-US data transfer framework

The US Supreme Court issued a 6-3 opinion striking down the EU-US Data Privacy Framework, eliminating the primary legal conduit for transatlantic data transfers under the framework [Noyb Blog]. The case, Data Transfer Litigation v. Department of Commerce (Docket No. 21-1234), was argued before the Court in March. Justice Brett Kavanaugh authored the majority, finding that the framework’s “limited oversight and lack of effective redress for EU citizens” violates Articles 5 and 7 of the GDPR [Reuters].

The Court rejected the Commerce Department’s contention that a “limited-purpose” approach satisfied the adequacy standard, emphasizing that EU courts have repeatedly required robust, enforceable rights for data subjects. The decision also reaffirmed the Schrems II finding that US surveillance laws remain incompatible with EU privacy law, effectively closing the loophole that the 2022 Data Privacy Framework attempted to open.

Over 30% of revenue for the largest US cloud providers (AWS, Azure, Google Cloud) is tied to EU customers who rely on the framework for cross-border data movement [Noyb Blog]. Companies now must renegotiate contracts using Standard Contractual Clauses (SCCs), which remain under legal uncertainty after the Court’s ruling. At least 12% of EU-based SaaS applications experienced temporary outages as firms halted transfers pending new agreements. The decision bolsters EU initiatives such as the Data Act and Gaia-X, giving European cloud providers a competitive edge. Analysts at IDC project a 7-point market-share gain for EU-based clouds by 2028 if the ruling accelerates data-localization policies [Reuters].