Schrems III and the Sea

Santiago doesn’t fight the marlin as an enemy. He respects it, even loves it. The real antagonist in that book was never the fish. It was the sea itself, indifferent, cyclical, impossible to finally defeat. And after eighty-four days without a catch, after three days lashed to the biggest fish of his life, he sails home with nothing but bones. The sharks strip the meat on the way back to shore. Everyone on the beach still understands what happened. The skeleton is the proof

.

Max Schrems has been fighting the same fish three times now, and the sharks keep winning the meat while he keeps bringing home the skeleton.

Safe Harbor. Privacy Shield. Now the Data Privacy Framework is on the ropes after the Supreme Court ruled on June 30, 2026, that the FTC's independence is unconstitutional. Within a day, noyb called it the collapse of the DPF. Schrems asked the European Commission to revoke the adequacy decision outright. Same fisherman, same water, third fish.

The pattern isn’t opportunistic scavenging in the villainous sense. It’s just what happens to anything left exposed in open water long enough. Each agreement is built the same way: an institutional promise instead of a technical one. The Commission looks at the US oversight structure, judges it to be independent and durable enough, and hands over EU personal data on that basis. Safe Harbor fell because self-certification wasn’t enforcement. Privacy Shield fell because a State Department ombudsperson didn’t provide independent oversight. The DPF’s Data Protection Review Court was built specifically to survive that objection, its judges insulated by executive order from at-will removal. The Supreme Court just ruled that a different agency, insulated the same way, doesn’t get to be independent after all. Shark bite number three, landing on the exact same wound.

Three collapses, one axis. The proof never traveled with the data. It was borrowed from the institution standing beside it.

Here’s what people miss about the old man’s story, though. Getting the fish home whole was never actually the win condition. Proving the fish could be caught was the win condition. The skeleton lashed to the boat is what the whole village needed to see, even with no meat left to eat. Schrems doesn’t need Privacy Shield to stay dead forever, and he doesn’t need this round to end in a deployed alternative either. He needs to keep demonstrating, publicly, repeatedly, that the fish can be hooked. That the framework built on institutional trust can be pulled apart the moment the institution’s footing shifts. Three times is a pattern people can set their clocks by.

This is why litigation here is such a blunt instrument, and why nobody wins under the current terms. Schrems doesn’t want three more years of transfer chaos. Companies don’t want to re-paper their legal basis every time an unrelated US court ruling shifts the ground under them. The Commission doesn’t want to torch a framework it just spent years negotiating. But nobody has a lever besides the binary one: adequate or not adequate, institution trusted or institution untrusted. There’s no partial credit in an adequacy decision. It’s a light switch bolted to a building that keeps changing occupants.

A litigant in this position doesn’t need a deployed alternative to force the question, same as Santiago didn’t need the meat to survive the trip to make his point. Once a credible alternative exists, even conceptually, the defense available to the current framework changes. It stops being this cannot be done and becomes this was not implemented. That’s a much weaker position to hold, and it’s the threshold every one of these cases has been quietly testing.

The credible alternative is not another adequacy framework. It is an architecture that moves the proof from the institution to the interaction itself. That is the actual breakthrough.

Once proof becomes a property of the interaction rather than of the institution overseeing it, adequacy no longer depends on whether governments remain unchanged. The proof travels with the transfer.

SSOAR defines the missing constraint at exactly this joint: a session- scoped authority boundary that binds identity, policy, and routing to the interaction itself, so what happened during a transfer is provable when it happened, not reconstructed afterward from institutional assurances.

Not a workaround for the FTC ruling. What “adequate” should have meant from the start.

One place the metaphor bends instead of holds: Santiago is alone, and the solitude is the point of the book, a man against the whole ocean, destroyed but not defeated. Schrems isn’t alone. noyb is a standing apparatus built for exactly this kind of fight, and each case doesn’t cost him the boat. It funds the next one. So this isn’t the tragic version. He’s not sailing back exhausted with nothing to show for it. He’s sailing back with a skeleton every few years, and the skeleton is starting to look less like defeat and more like a forecast.

Everyone in this fight wants the same outcome: lawful, durable, transatlantic data flows. noyb wants rights preserved. The Commission wants stability. Companies want predictability. The United States wants commerce. They are fighting over institutions because institutions are where the proof currently lives. Move the proof into the interaction itself, and the fight changes.

Litigation has become the only mechanism capable of testing whether an institution is still trustworthy. That is an extraordinarily expensive way to validate a data transfer.