After Slaughter: FTC independence and EU-US DPF face potential challenges

The U.S. Supreme Court's decision in Trump v. Slaughter is expected to reshape the Federal Trade Commission's leadership structure while raising questions about the stability of the EU-U.S. Data Privacy Framework.

The court ruled that FTC commissioners may be removed by the president without cause, expanding presidential control over the agency by removing protections that prevent FTC commissioners from being fired for political reasons.

IAPP Managing Director, Washington, D.C., Cobun Zweifel-Keegan, CIPP/US, CIPM, hosted a LinkedIn Live 6 July highlighting concerns surrounding potential shifts for the FTC. Zweifel-Keegan was joined by Wilson Sonsini Goodrich and Rosati Partner Maneesha Mithal, the former head of the Division of Privacy and Identity Protection at the FTC. The discussion suggested as the FTC faces challenges, there may be less incentive to maintain a bipartisan commission.

Though many argue the FTC has faced issues about its ability to remain politically neutral over the last several years, Mithal noted she believes with the Supreme Court's decision, "there's going to be a lot less predictability, a lot less continuity at the FTC. The pendulum used to not swing that far in either direction, and now I think you're going to see great swings in the pendulum."

The FTC's structure

The Supreme Court's position has implications for Humphrey's Executor v. United States, which aimed to allow independent government agencies to make decisions while limiting the president's power to fire officials. Though the decision changes the FTC's legal structure, Mithal said the decision's impact may not be imminent.

"I wouldn't say that this moment is a sea change, because, in a way, the FTC has been operating in a very partisan way for the last several years," Mithal said.

Though the ruling could significantly change the FTC's makeup by giving future administrations greater control over the commission's structure. Rather than maintaining the traditional bipartisan structure of five commissioners, Mithal believes the "days of five commissioners are gone, and I think there's no incentive to have five commissioners."

The FTC is expected to continue enforcing consumer protection and privacy laws, though it could have implications for organizations. The decision is unlikely to change organizations' privacy obligations, businesses may face greater uncertainty as enforcement priorities shift between administrations.

"Companies may forego long-term investments because of regulatory uncertainty, and to be fair, I think that's been true over the last five years," Mithal said. "I do think the FTC is going to have a huge incentive to fast-track investigations and settlements to make sure that they're done within the current administration, because there's going to be a lot of uncertainty as to how the next administration will view those ongoing settlement discussions."

While companies may look to adapt their response to certain digital safety issues, Mithal noted concerns such as AI safety, children's privacy, targeted advertising and consumer protection typically remain consistent throughout shifts in presidential administrations despite varying approaches.

"I think the list is pretty long of things that don't change from one administration to another, and priorities that don't change from one administration to another," Mithal said. "That's the kind of hope we can focus on, so that we can kind of use that to build and address" potential enforcement continuity concerns.

EU-US Data Privacy Framework

The ruling has also raised concerns about the stability of the EU-U.S. Data Privacy Framework. The DPF requires that data protection standards and international transfers are overseen by an independent authority. EU privacy group NOYB plans to file a legal challenge of the DPF and has urged the European Commission to exit the agreement, arguing it depends on the independence of U.S. oversight bodies, like the FTC. With challenges to the FTC's structure, some privacy groups believe the U.S. can no longer satisfy the DPF's expectations.

"I think you see people saying, 'well, it's no longer independent, so the foundation for the Data Privacy Framework is no longer appropriate," Mithal said. She noted the decision most likely will not affect binding corporate rules and contractual clauses "because there still is an appropriate level of protection in the U.S."

Despite potential changes to the FTC, the agency will continue to issue enforcement against companies that violate privacy regulations. "The FTC has not shown any retreat from commitments to enforce privacy process. So, I think there's an argument that it wouldn't change those other forms of data transfers," Mithal said.

Despite legal uncertainty, Mithal emphasized the FTC's core consumer protection mission will likely continue. She pointed to continued bipartisan support for enforcement involving fraud, children's privacy, deceptive practices and AI-related concerns, suggesting those priorities are expected to remain consistent regardless of changes to the agency's structure.