Clinical Trials May Need a Backup Plan for U.S.–EU Data Sharing

The Supreme Court’s June 2026 ruling in Trump v. Slaughter may affect how U.S. clinical trial sponsors receive long-term safety data from Europe. The ruling invalidated statutory removal protections for Federal Trade Commission (FTC) commissioners. That matters for the EU-U.S. Data Privacy Framework (DPF), which allows personal data transfers from the EU to eligible, certified U.S. organizations. The FTC enforces participating companies’ privacy commitments, and the European Commission expressly relied on protections for the FTC’s independence when approving the framework. The DPF remains in force, but European regulators are examining whether U.S. protections still meet EU standards given the changes from Trump v. Slaughter. 

Why FTC Independence Matters for the DPF

The independence of FTC commissioners was part of the European Commission’s assessment that U.S. protections were essentially equivalent to those required in the EU. In recital 60, the Commission specifically pointed to commissioners’ seven-year terms and protection against dismissal except for specified causes as features of the FTC’s independence. It is worth noting that the Commission’s original positive assessment also rested on safeguards against U.S. intelligence access and mechanisms for challenging that access. Slaughter does not directly change those arrangements. 

On July 31, the European Data Protection Board, which brings together EU privacy regulators, asked the Commission to assess Trump v. Slaughter’s implications. The question is whether the overall system still provides the protection EU law requires. 

Impact on U.S. Sponsors

For some gene therapies, the FDA recommends following patients for up to 15 years to detect delayed side effects. In a study spanning Europe and the United States, that can mean years of sharing health information across the Atlantic. An interruption in those transfers could delay the combined safety assessments needed to identify problems across the study population. But the legal arrangements supporting those transfers can change while a study is still underway. In Schrems I (2015) and Schrems II (2020), the EU’s highest court struck down Safe Harbor and Privacy Shield, the two frameworks that preceded today’s DPF. Those cases concerned inadequate safeguards against U.S. government access to personal data and insufficient legal remedies. For U.S. sponsors working with EU trial sites, that history, together with the current uncertainty about the DPF following Trump v. Slaughter, is a reason to revisit their existing transfer arrangements. Consider a U.S. sponsor receiving follow-up reports from European sites to identify delayed side effects. If those transfers rely solely on a framework that is legally vulnerable to EU invalidation, losing that route could mean needing to change contracts, service providers, or access arrangements while patients still need monitoring.

Sponsors should therefore assess whether a workable alternative is available and how long it would take to implement; those already using contractual safeguards should revisit whether they remain sufficient. The aim is to avoid interruptions in data sharing that may delay pooled safety assessments or analysis of results — evidence needed to guide treatment decisions on both sides of the Atlantic.

To assess what this uncertainty means for a particular study, sponsors first need to establish which transfers rely on the DPF. The framework’s coverage is limited: Many nonprofit research institutions cannot participate because they fall outside the relevant U.S. enforcement authorities’ jurisdiction. Those institutions already need other legal arrangements for receiving personal data from Europe.

Can Contracts or Consent Provide a Fallback?

The EU’s standard contractual clauses are one possible route for transfers outside the DPF, where they fit the parties and processing involved. They bind the parties to data protection obligations, but signing them does not settle whether a transfer is lawful: The parties must also assess whether U.S. laws and practices allow the recipient to comply with those obligations. Additional safeguards or changes to how the data are shared may be necessary.

Denmark’s data protection authority has already warned that Slaughter may also affect transfers based on these contracts. It has urged organizations to revisit their assessments of U.S. protections, particularly independent review, and their exit strategies. 

Sponsors cannot assume that patients’ consent to participate authorizes all future international transfers. EU law distinguishes consent to participate in a trial from consent to processing personal data and provides a separate exception for transfers without ordinary safeguards. That consent exception requires specific information about the transfer risks and allows patients to withdraw their consent. If a participant does so, further transfers of their data would need another legal basis.

Planning for the Full Life of a Trial

Sponsors and European trial sites should involve their legal, clinical, and data management teams in assessing proposed alternatives. These teams should identify the necessary changes, assign responsibility for implementation, and establish whether safety reporting could continue during the transition. Revised arrangements must support the study’s data collection and analysis requirements.

The Commission has a continuing duty to monitor U.S. protections. It should explain whether the loss of commissioners’ removal protections changes its assessment and what its conclusions mean for organizations using the DPF. That explanation would help sponsors decide whether, and when, to change their arrangements.

Over 15 years of follow-up, the legal arrangements supporting a study may change even as patients continue to be monitored for delayed effects. Sponsors should plan for that possibility and revisit transfer arrangements throughout follow-up. The aim is to manage changes in transfer rules while protecting participants’ information and keeping it available for the safety assessments that made years of monitoring necessary in the first place.