What happened in Washington
On 29 June, the US Supreme Court handed down one of the most consequential decisions in its recent history. In Trump v. Slaughter, six of nine justices ruled that the US President may dismiss the members of so-called independent federal agencies at will, without giving reasons, without misconduct, purely because of political disagreements. In doing so, the Court overturned a precedent from 1935 that had guaranteed the independence of these agencies for ninety years.
The background: President Trump had dismissed two commissioners of the Federal Trade Commission (FTC), even though the law only allowed dismissal for breach of duty. The Supreme Court ruled in his favour, and did so fundamentally. The decision affects not only the FTC but around two dozen federal agencies whose leadership had until now been protected from direct control by the White House. Only the US Federal Reserve was expressly exempted. Justice Sonia Sotomayor summed it up in her dissent: the result is “a President with far greater power than ever before”.
The ruling is relevant for European companies, because the FTC plays a central role in the EU-US Data Privacy Framework.
The invisible bridge your data stands on
With Microsoft 365, Google Workspace and other international services, possible third-country transfers depend on the specific service, the configuration and the subcontractors involved. Company headquarters, storage and processing must be assessed separately. The legal basis of an actual transfer must be evaluated on the basis of the respective contract and data flow.
And it rests on one central assumption: that in the USA an independent supervisory authority ensures that US companies keep their data protection commitments. This supervisory authority is the FTC. The European Commission's adequacy decision refers to the FTC as an independent enforcement authority in 259 places.
Under the European understanding, an authority whose members the President can remove at any time is not considered independent. The ruling therefore calls into question the independence on which the adequacy decision is based. And it does not only affect the FTC. The other oversight bodies on which Europe's data protection assessment relies are now also in question: the oversight board for civil liberties in intelligence access and the Data Protection Review Court, which the European Commission cites as legal redress for Europeans. The latter was never established by law in any case, but only by a presidential order that the same President can revoke at any time.
Safe Harbor, Privacy Shield and the Data Privacy Framework
Europe's fundamental rights framework is unequivocal on this point: the EU Charter of Fundamental Rights and the EU Treaties require compliance with data protection to be monitored by an independent authority. No independent oversight, no adequacy. The equation is that simple, and the European Court of Justice has already applied it twice: in 2015 it struck down the Safe Harbor agreement, in 2020 the Privacy Shield. Both times, European companies were left overnight without a legal basis for their US data transfers.
Now the third agreement is wobbling. Max Schrems's data protection organisation noyb has already formally called on the European Commission to withdraw the adequacy decision and has announced a new lawsuit before the European Court of Justice. Whether it is the Commission or the Court that acts, we know the pattern: it takes months or a few years, then the decision comes, and it comes abruptly.
The framework remains in force for now. For long-term planning, it is worth designing data flows so that they are independent of future decisions on US data transfers.
What this means for your company in concrete terms
Check the legal basis of your US data transfers. There are only two common answers, and both are affected by the ruling:
- Data Privacy Framework: Your provider is DPF-certified, and your transfers depend directly on the adequacy decision. If it falls (through withdrawal or a court ruling), you will need a new basis overnight.
- Standard contractual clauses: Then you had to carry out a Transfer Impact Assessment: an assessment of whether your data is safe in the destination country. These assessments usually rely on precisely the oversight structures whose independence the Supreme Court has just removed. You should therefore review these assessments in light of the ruling and rewrite them.
And even those who somehow patch up the legal side should see the bigger picture: this ruling is not an aberration, but part of a trend. Power over the American administration (and with it over the rules under which US technology companies operate) is increasingly concentrated in a single place. We have explained why this affects the entire digital workplace, and not just the data question, in the article Why Europe needs sovereign AI and a sovereign Office .
The answer is not a fourth agreement
One can now hope that Brussels and Washington will cobble together a fourth data agreement that then holds until the next ruling. Safe Harbor, Privacy Shield, Data Privacy Framework: the series does not suggest that the fourth attempt will be the lasting one. The structural truth is less comfortable: as long as European companies' data is processed in a foreign jurisdiction, its protection depends on political constellations over which Europe has no influence.
That is why the real lesson of this ruling is not legal but strategic: Germany and Europe need digital sovereignty: their own infrastructure, their own AI, their own services, under European law. Not out of principle and not against America, but as simple risk management. A company whose data never leaves Europe does not have to fear adequacy decisions, tighten up transfer assessments or look to Washington before planning its own future.
Our answer: the most stable legal basis is the transfer that never takes place
At Nexoria, the core platform's files, databases and knowledge index are held on servers in Germany; semantic search is also processed there. AI answer generation is handled by Mistral AI in France. We consider other services separately: technical error monitoring runs via Sentry, which is based in the USA, without access to document content, and is named in the processing register under Art. 30. Email integration via the Microsoft Graph API and Gmail API only applies when the integration is active. For the optional VoiceBot, Telnyx provides the telephone connection in Frankfurt. ChatGPT (OpenAI), Claude (Anthropic), Gemini (Google) and Langdock can optionally be connected to Nexoria. Nexoria also works without these integrations. When connected, shared content is transferred to the respective provider. That provider's terms, processing locations and settings apply. The providers and data flows involved are listed under Security.
When assessing Nexoria, you can distinguish the data flows of the core platform from additional services and activated integrations. What matters are the functions actually used, the providers involved and the associated contractual documents.