noyb argues the ruling creates a Catch-22 that directly contradicts the 'effective redress' condition baked into the 2023 adequacy decision and the Schrems II standard. Since Section 702 collection is classified by statute, no one — US or EU citizen — can meet the new standing bar, which means the DPF's foundational premise that EU subjects have 'essentially equivalent' redress is now demonstrably false.
By submitting the noyb analysis under the headline 'US Supreme Court Just Blew Up EU-US Data Transfers' and driving it to 149 points, the submitter endorses the framing that this ruling is a structural, not incremental, threat to the DPF. The post positions the SCOTUS decision as the trigger event for a likely Schrems III invalidation.
The editorial frames the 6-3 decision as a Kafkaesque construction: plaintiffs must prove specific targeting under a program whose targeting decisions are classified by statute and adjudicated in sealed FISA Court proceedings. It argues that the practical effect is to limit surveillance challenges to whoever the government voluntarily notifies, gutting Article III review of Section 702 entirely.
The editorial highlights that the dissent spent fourteen pages flagging precisely this circularity — that the majority's standing test is unmeetable by design because the underlying surveillance is classified. The dissent's position is that this collapses the constitutional check on Section 702 collection.
The editorial points to Paragraph 175 of the 2023 adequacy decision, which conditions adequacy on 'effective administrative and judicial redress,' and to Schrems II's requirement that redress be available to data subjects in practice rather than on paper. With the Supreme Court confirming that US citizens themselves cannot access such redress, the EO 14086 / DPRC scaffolding fails the very test the Commission used to greenlight the DPF.
On June 27, the US Supreme Court issued its decision in *FBI v. Fazaga*-adjacent surveillance standing cases, ruling 6-3 that plaintiffs challenging Section 702 FISA surveillance must prove they were personally and specifically targeted to have standing to sue. The catch — the one that the dissent spent fourteen pages flagging — is that Section 702 collection is classified by statute. You cannot prove you were targeted, because the government will neither confirm nor deny it, and the FISA Court proceedings are sealed.
In effect, the Court has ruled that the only people who can challenge mass surveillance are the people the government decides to tell. Max Schrems' organization noyb — the Austrian NGO that already killed Safe Harbor (Schrems I, 2015) and Privacy Shield (Schrems II, 2020) — published a blistering analysis within 48 hours arguing this ruling has direct, structural consequences for the third framework, the 2023 EU-US Data Privacy Framework (DPF).
The DPF is the legal scaffolding that lets roughly 5,300 self-certified US companies — including every hyperscaler you actually use — receive personal data from EU data subjects without triggering Article 46 transfer impact assessments. It was built on a specific bet: that Executive Order 14086 and the new Data Protection Review Court would provide EU citizens with 'redress essentially equivalent' to what they'd get in an EU court. The Supreme Court just confirmed that US citizens themselves don't have that redress. EU citizens, by extension, demonstrably do not either.
The EU Commission's 2023 adequacy decision (C(2023) 4745) is explicit on this point. Paragraph 175 conditions adequacy on the availability of 'effective administrative and judicial redress.' The Schrems II judgment (Case C-311/18) set the bar even higher: redress must be available to data subjects, not merely theoretically existent in statute books. Standing doctrine that requires proof of secret surveillance is the textbook example of theoretically-existent-but-practically-unavailable redress. The CJEU has already rejected this exact pattern twice.
The timeline matters more than the legal theory. noyb has confirmed it will file fresh complaints with the Irish DPC and the French CNIL within weeks, citing the SCOTUS ruling as a material change in circumstances triggering review under Article 45(4) GDPR. The Commission is statutorily required to monitor adequacy 'on an ongoing basis' and to suspend or repeal when conditions are no longer met. The Article 29 Working Party (now EDPB) has historically moved on roughly 18-month timelines for invalidation, but Schrems II showed they can move faster when a court forces the issue.
The community reaction on Hacker News (149 points, ~340 comments) split into three camps that are worth taking seriously. The 'this changes nothing' camp argues the DPF was always a political fiction maintained by mutual European-American economic convenience and will be maintained regardless of any single ruling. The 'Schrems III is inevitable' camp — which includes most of the GDPR practitioners in the thread — points out that the Commission has now lost two adequacy decisions in seven years and the third is built on weaker foundations than either of the prior two. The third camp, smaller but technically interesting, argues that the practical workaround is no longer SCCs (Standard Contractual Clauses) because Schrems II already neutered those for US transfers; the only durable answer is EU data residency with EU-controlled keys.
The hyperscaler 'sovereign cloud' offerings — AWS European Sovereign Cloud, Microsoft EU Data Boundary, Google Sovereign Controls — were built for exactly this scenario, and none of them are production-ready for the workloads most SaaS companies actually run. AWS European Sovereign Cloud has no GA date and currently advertises 'planned for end of 2025.' Microsoft's EU Data Boundary covers core services but explicitly excludes most AI/ML workloads and several Dynamics modules. Google's offering requires Thales as the key custodian, which adds latency and a procurement path that takes 6+ months at most enterprises.
If you operate a B2B SaaS that processes EU personal data on US infrastructure, three things change this week and you should not wait for legal to send a memo.
First, audit your DPF reliance. Pull your transfer impact assessments and check whether your legal basis for any US transfer is 'adequacy decision under DPF' versus SCCs with supplementary measures. If you're DPF-only, you have single-point-of-failure exposure. Add SCCs with technical supplementary measures (end-to-end encryption with EU-held keys, pseudonymization at ingress) as a belt-and-braces fallback now, while the DPF still legally holds. Doing this after invalidation means doing it under a 30-day DPA letter with your CTO's calendar already on fire.
Second, inventory which of your US-region workloads actually need to be US-region. Most SaaS companies discovered during Schrems II prep that 60-80% of their EU customer data could run in eu-west-1 or eu-central-1 with no architectural change beyond a Terraform region variable and a CDN config. The remaining 20-40% — usually analytics pipelines, ML training, and shared customer support tools — are the painful part. Start the painful part now. Vendors like Snowflake, Databricks, and most observability stacks (Datadog, New Relic) have EU regions; switching is mostly a data migration and a contract amendment, both of which take weeks not days.
Third, look at your sub-processor list with fresh eyes. Your GDPR Article 28 obligations flow through to every sub-processor, and every US-incorporated sub-processor inherits this risk regardless of where their servers physically sit — because Section 702 obligations attach to the entity, not the metal. Cloudflare, Stripe, Twilio, OpenAI, Anthropic, every analytics SDK in your frontend: all US-incorporated, all subject to Section 702 demands they cannot tell you about. The EU regional endpoints help but do not fully solve this.
The likely path is messy. The Commission will not voluntarily repeal adequacy — Brussels has too much political capital in the framework and the trade implications are an order of magnitude larger than the privacy ones. noyb's complaints will work through the Irish DPC (slow) or be referred to the EDPB for a binding decision (faster). A national DPA — probably the French CNIL or the German federal commissioner — may move unilaterally with a transfer suspension order against a specific US company, which is the mechanism that forced Schrems I and Schrems II to their conclusions. The realistic Schrems III invalidation window is 12-24 months, with elevated DPA enforcement starting roughly now. The companies that will sail through it are the ones that treat EU data residency as a first-class architectural concern this quarter, not a compliance checkbox next year.
Doing business with the US is just impossible these days. If this trend continues any further the US is gonna end up a piranha state with no allies and no business partners.I'm really not sure what consequences that'll have for the rest of the world, but it looks like we're about to f
Europa, the official web portal of the tech sovereign European Union, will have to change their CDN provider (Amazon's CloudFront).https://europa.eu
I wonder how many billions in lobbying money Schrems has cost various big companies.The treaties and deals he has managed to torpedo by forcing courts to uphold privacy laws is insane (and impressive).
The EU keeps trying to manifest the missing european data infrastructure via data regulation instead of outright bans and limits on american companies, the way China did it.
Top 10 dev stories every morning at 8am UTC. AI-curated. Retro terminal HTML email.
Switching to EU companies is often the solution, but also we're in a tricky position in Europe since alternatives exist but can't compete with US. So finding European alternatives is possible but hard. Also EU is doing its job enforcing privacy and anti-competition laws but then American c