Why the location of data really matters

On June 29, 2026, the US Supreme Court ruled in Trump v. Slaughter that the statutory protection of FTC commissioners from removal without cause violates the constitutional separation of powers. With the overturning of Humphrey’s Executor, a key institutional safeguard for the political independence of the Federal Trade Commission was eliminated. For most organizations in Europe, this may sound like an internal detail of US administrative law. But it is not for companies and authorities that use software with US connections: theFTC is the supervisory authority on whose independence the entire EU-US Data Privacy Framework (DPF) is legally based – that is, the agreement that currently legitimizes data transfers from the EU to the US for providers. 

This development is not a cause for alarm, but it does highlight why a close look at the issue is unavoidable: Where are our data actually located, and which law applies to them there?

GDPR: Why data transfers to third countries are an issue at all

The GDPR allows the transfer of personal data to countries outside the EU only if there is an adequate level of data protection or appropriate safeguards in place, such as standard contractual clauses (SCCs). Since the Schrems II judgment of the European Court of Justice on 16 July 2020, standard contractual clauses (SCCs) do not automatically suffice for transfers to third countries. Data exporters must assess on a case-by-case basis whether the law and practice in the recipient country – in particular, government access powers – allow for a level of protection essentially equivalent to that guaranteed by the GDPR and the EU Charter of Fundamental Rights. If this is not the case, effective additional safeguards are required; if these are not sufficient, the data transfer must be suspended or terminated. This was particularly relevant for transfers to the US under the US surveillance rules that were examined at the time. 

The current basis for data transfers to US companies certified under the EU-US Data Privacy Framework is the European Commission’s adequacy decision of 10 July 2023. The decision relies on the FTC for the enforcement of DPF obligations against participating companies, explicitly describing it as an independent supervisory authority. Following the US Supreme Court’s ruling in Trump v. Slaughter, which declared the statutory removal protection of FTC commissioners unconstitutional, this assumption of the Commission is legally challenged. However, the decision remains in force for the time being.

The first challenge to the adequacy decision was dismissed by the Court of Justice of the European Union on 3 September 2025 in the Latombe/Commission case. An appeal against this judgment is pending before the Court of Justice of the European Union (C-703/25 P). At the same time, noyb, citing Trump v. Slaughter, is calling for a re-evaluation or revocation of the DPF and is considering further legal action. A possible renewed judicial review is informally referred to as “Schrems III”.

In summary, the legal basis on which many organizations use their software solutions with US connections, such as video conferencing, is currently valid, but noticeably more fragile than it was just a few years ago.

Why an EU data center doesn’t automatically solve the problem

A European server location alone does not automatically protect against US access if the provider is a US company or is subject to a US parent company. The CLOUD Act requires US companies to disclose stored data at the request of US authorities – regardless of whether the server is located in Virginia, Frankfurt, or Dublin. For the CLOUD Act, the location of the data storage is irrelevant, but the company’s headquarters is not. 

This is not just a theoretical issue, as was demonstrated in June 2025 before the French Senate: A Microsoft representative had to admit that the company could not categorically exclude US authorities from requesting European customer data. Despite European data centers and contractual commitments to data residency. This applies structurally to any provider with a US parent company. 

For video conferencing solutions, this means in concrete terms: A German or EU data center is a sensible first step, but it is not sufficient proof of GDPR compliance as long as the provider itself is subject to US law.

What to look for when choosing software

The location of data is not just a technical detail, but a matter of legal certainty. And that legal basis is more uncertain in 2026 than many organizations want to admit. An EU data center is a good starting point, but it is the combination of the company’s headquarters, the contractual basis, and actual operational control that determines whether the use of software is truly GDPR-compliant and future-proof. Anyone who wants to be permanently independent of the development of transatlantic data transfers will hardly be able to avoid European-controlled or self-hosted open-source solutions. This makes digital sovereignty practically feasible for both companies and government agencies.