Trump v. Slaughter: The end of transatlantic data flows ?

On June 30, the NGO Noyb, a thorn in the side of digital giants and regulators, sent a letter to the European Commission asking it to schedule the exit from the transatlantic data protection framework (the Data Privacy Framework or DPF).

According to the NGO, the United States no longer guarantees any independent oversight regarding privacy.

While President Trump had already dismissed 2 of the 3 members of the “Privacy and Civil Liberties Oversight Board”, an independent oversight body created by Congress in 2004, the United States Supreme Court has undoubtedly just dealt a death blow to the American independent oversight system.

In a 180° reversal of its previous jurisprudence, the Court decided on June 29 that the independence of the Federal Trade Commission (FTC) was unconstitutional.

The "Trump v. Slaughter" ruling falls within the framework of a "unitary" theory, according to which the president must exercise power over all American executive bodies.

According to this doctrine, American laws that grant independence to various agencies are therefore unconstitutional.

“Given that the European Union has relied heavily on the FTC’s ’independence« as its privacy watchdog, the entire structure of the EU-US data protection framework has just collapsed.»

Noyb President Max Schrems adds that with the United States still exerting considerable pressure on the EU to keep personal data flowing, his NGO will also launch legal action in the coming weeks, with the aim of enabling the Court of Justice of the European Union (CJEU) to annul the current agreement.

A "Schrems III" ruling could therefore complete the activist's list of achievements.

MP and CNIL member Philippe Latombe also sent a letter to the European Commission requesting the cancellation of the transatlantic treaty and urging French companies to implement sovereign data management solutions.

It should be recalled that the decision of the European Commission, which acknowledges the adequacy of the protection framework put in place by the United States, remains in force until the Commission or the CJEU declares it invalid.

A procedure before the Court generally takes between two and three years before a final decision is reached.

The Commission may, however, not wait for the outcome of such a procedure: it has already announced, in response to questions from the media, that it intends to analyze the validity of its adequacy decision given the lack of independence of the FTC.

The Danish data protection authority further indicated in a statement on July 1 that the decision of the United States Supreme Court could have particularly broad repercussions, affecting not only transfers based on the DPF, but also transfers made via other legal bases, for example based on standard contracts.

The authority encourages data controllers to review their assessment of the level of protection guaranteed by the recipient country in the context of their transfer impact assessment.

It is particularly important to verify whether the prerequisites for independent control by the authorities are still met.

For data controllers and data protection officers (DPOs), this news provides an opportunity to update their mapping of transatlantic data transfers, including SaaS, cloud or AI tools, to reassess their legal basis and to identify possible alternatives where appropriate.

In France

Following a public consultation, the CNIL published on June 30 its recommendations on the use by professionals of location data from connected vehicles (cars, bicycles, scooters, etc.).

Its objective is to strengthen legal certainty and provide greater transparency for users.

In a fact sheet updated on June 19, the CNIL reiterates its essential recommendations regarding the use of digital technology in business.

It lists 12 recommendations and encourages data controllers to carry out a diagnosis via the government's website.

It also specifies in a publication dated June 10 the rules to be followed in the event of electronic communications to prospects and customers.

On July 3, the CNIL published the results of its survey aimed at analyzing the evolution of the role of DPOs in the face of the development of artificial intelligence (AI).

She is interested in AI governance in organizations, new regulatory challenges related to the articulation between the GDPR and the European regulation on AI, as well as the needs of DPOs in terms of skills, training and tools.

While the DPO remains a key player in ensuring the protection of personal data in AI projects, he is not intended to manage this compliance alone and does not yet have a thorough understanding of the regulation.

The CNIL intends to adapt its recommendations and support for professionals to these new challenges and refers to the tools already available on its website.

On Tuesday, June 16, the Prime Minister announced in a video posted on social media an additional public investment of 655 million euros through the France 2030 program in order to accelerate the development of AI in France.

«"One of the most symbolic announcements concerns the General Directorate for Internal Security (DGSI), which is ending its partnership with the American data analysis giant Palantir.

To replace this foreign technology, the DGSI chose the French company ChapsVision.

This concern has been reinforced recently by the US administration's decision to restrict access to certain advanced artificial intelligence models for foreign nationals, in the name of national security.

The government also wants to accelerate the adoption of AI in the administration.

A sovereign conversational assistant will be gradually rolled out to approximately one million state civil servants.»

On the same subject, the testing of a Chinese language model at the Directorate General of the Treasury was interrupted on June 23 because of "leading" or "biased" responses.

The chatbot was intended to assist senior officials in their daily tasks, including the processing of confidential or sensitive data.

A new model from the French start-up Mistral AI was installed on Wednesday.

From 2027, the French National Cybersecurity Agency (ANSSI) will cease to certify security products that do not have encryption mechanisms resistant to quantum computers.

This requirement will particularly concern products intended for sensitive sectors such as defense, armaments and public administrations.

Companies have until 2030 to purchase only so-called "quantum-safe" solutions.

Accelerating the transition to post-quantum cryptography was also at the heart of the work of the G7 cybersecurity subgroup which met under French presidency in early June.

The data protection authorities of the G7 countries also met in Paris on June 25 and 26 at the invitation of the CNIL as part of the French presidency of the G7.

They adopted a declaration on privacy-respecting age verification mechanisms, as well as a document on the development of connected objects that respect the privacy of minors.

In Europe

European institutions and bodies

On June 29, the EU Council gave its final approval to the simplification and streamlining of AI rules provided for in the Omnibus Regulation.

The application of the rules relating to high-risk systems is postponed to December 2, 2027 for standalone high-risk AI systems and to August 2, 2028 for high-risk AI systems integrated into products.

The text adds a provision to the AI regulation, prohibiting AI practices related to the generation of non-consensual sexual and intimate content or child pornography.

Artificial intelligence systems that generate images of real people naked or that remove clothing from existing photos in order to reveal intimate parts will also be banned from December 2026.

The new regulation postpones to August 2, 2027 the deadline for the establishment, by the competent authorities at national level, of regulatory "sandboxes" dedicated to AI, and reduces from 6 to 3 months the period granted to providers to implement transparency solutions concerning artificially generated content, the new deadline being set at December 2, 2026.

According to a document seen by Politico, European Parliament President Roberta Metsola is attempting to pass a controversial law on filtering online child pornography content (CSAM), a law rejected last March by her own assembly in plenary session.

The president asked the member states gathered in the Council to approve a draft that would allow technology platforms to voluntarily scan their services for child pornography content, an issue that is the subject of intense controversy: the police and some child rights advocates as well as several European commissioners argue that the lack of legislation allows predators and pedophiles to act with impunity on the Internet.

Privacy advocates and security experts, meanwhile, believe these proposals could lead to unacceptable mass surveillance and the end of encryption.

On June 18, 2026, the CJEU clarified in its judgment C-484/24 – NTH Haustechnik that personal data obtained unlawfully should not be automatically excluded from legal proceedings.

The courts may use them if it is strictly necessary and proportionate to the exercise of their mission, while respecting the principles of the GDPR, in particular data minimization.

However, this possibility does not make the initial collection of information lawful and does not exempt its author from possible violations of data protection rules.

The European Data Protection Board (EDPB) adopted a model for data breach notification on June 10.

This model is primarily intended to be implemented by the APDs using a computer tool.

The model is subject to public consultation, thus offering stakeholders the opportunity to share their comments and feedback on its content until August 5th.

From August 3rd, Google will use the IP addresses of internet users located in the European Economic Area, the United Kingdom and Switzerland to measure and personalize advertisements.

While Google already collects this data for technical reasons, its use is evolving: the IP address can now be used to identify devices for advertising targeting purposes.

This practice, governed by the GDPR, will require user consent, which should be integrated into the mechanisms already used for managing advertising preferences and cookies.

News from the member countries of the European Union.

Belgian and Spanish data protection authorities (DPAs) jointly published recommendations and best practices for the video game sector on June 18.

This collaboration stems from the need identified by the authorities to regulate a sector that involves more than 3 billion users worldwide and uses intrusive technologies.

The document analyzes the most common personal data processing activities in video games, identifies the threats and risks they entail, and proposes recommendations and best practices.

In Croatia, the APD fined a real estate agency for retaining customer data beyond the purpose of the processing, storing copies of identity documents and bank cards without legal basis, and providing insufficient training to its employees on the processing of personal data.

The Spanish Data Protection Agency (APD) published guidelines on June 8 regarding the use of cameras in nursing homes to reconcile care and privacy.

It also fined Vodafone España €1,050,000 after a third party managed to bypass security controls to obtain a customer bill containing an unauthorized email address, and create a second mobile line fraudulently registered in the complainant's name.

It finally fined CaixaBank €500,000 for systemic failures in data protection, following repeated security breaches.

The authority specifically asked the bank to improve its breach detection capabilities and strengthen its procedures for identifying the people and data involved in the event of an incident.

The Irish Data Protection Authority (DPA) has fined the Health Service Executive (HSE), the public health service, €300,000 following a 2018 ransomware cyberattack that compromised the personal data of approximately 84,000 patients.

The investigation concluded that the HSE had not implemented sufficient technical and organisational security measures, did not have GDPR-compliant documentation and had not properly supervised its subcontractors.

In addition to the fine, the DPC ordered the HSE to sustainably strengthen its data security policies and procedures.

The Norwegian Data Protection Authority (APD) has imposed an administrative fine of 20 million Norwegian kroner on Elkjøp, notably for lack of valid consent to the processing of personal data in the context of its loyalty club, insufficient assessments concerning new purposes of processing, and failure to respond to requests from data subjects within the time limits provided for by the GDPR.

Internationally

In the UK, a Derbyshire police officer is under investigation after being accused of using artificial intelligence to fabricate evidence in several court cases.

Authorities are reviewing potentially relevant files, while the officer has been removed from operational duties.

This case, which could constitute a serious misuse of justice, comes at a time when British police forces are increasing their use of AI, reigniting the debate on the risks and the need for strict regulation of these technologies.

Several police departments have recently been asked to suspend certain uses of AI, particularly in drafting documents for the courts, due to factual errors.

In the United Kingdom as well, from June 19, organizations subject to British data protection legislation are required to put in place a procedure enabling natural persons to make complaints concerning their personal data.

Individuals must first address their complaint to the organization concerned before contacting the Information Commissioner's Office.

In China, the Provisional Measures Relating to the Management of Anthropomorphic Interactive Services Based on Artificial Intelligence will come into effect on July 15.

This regulation governs the rapidly expanding sector of AI-based virtual companions and emotional support robots.

Providers of these services will notably have to clearly inform users that they are interacting with an AI, put in place mechanisms to prevent emotional dependence, detect situations of distress or risk, protect minors and limit their access to virtual companions.

They will also have to comply with governance requirements, such as registering their algorithms, conducting security assessments in certain cases, and implementing data protection and risk management measures.

The Ibero-American Network for Data Protection (RIPD) has adopted a reference document aimed at strengthening the safeguards applicable to the processing of "neurodata", which comes from technologies capable of measuring or inferring brain activity.

The text recommends enhanced protection of this data, increased transparency on its use and operation, as well as restrictions, or even prohibitions, for certain uses deemed incompatible with fundamental rights, particularly when they aim to manipulate behavior or exploit vulnerable people.

Anthropic has decommissioned its two most powerful AI models.

Citing "national security" concerns, Washington had demanded that the American start-up specializing in artificial intelligence limit access to Claude Fable 5 and Mythos 5 to American citizens only.

According to Anthropic, this request is impossible to implement. On May 22, Anthropic announced its Glasswing project, stating that its cybersecurity AI model, Mythos, had identified more than 10,000 vulnerabilities in widely used open-source software and projects.