On June 27, 2023, The United States Supreme Court ruled to expand and reinforce state authority over registered corporations within a state’s respective jurisdiction. Per Mallory v. Norfolk Southern Railway Co. (2023), even if a lawsuit pertains to events occurring outside the state in which a corporation primarily operates, a corporation may be sued in said different state. As an attempt to determine the constitutionality of Pennsylvania state law under the Fourteenth Amendment’s Due Process Clause, the case’s ruling concerns Pennsylvania’s contested Consent-by-Registration law. Consent by registration requires that corporations must agree to be sued in the state in which they are conducting business, prior to beginning operations. Thus, as was the case for Norfolk Southern Railway Co., even just as much as a railway built going through any territory in the state would obligate the firm to appear in the state’s court.

In both the United States and European Union, protection of personal data is an essential right. Transatlantic data exchanges are projected to form the foundation of over $1 trillion in yearly trade and investment for multinational companies. Despite its lucrative potential and the United States’ reliance on transatlantic transfers of personal data for national security, the legality of such transfers has yet to be clearly outlined. Since the Court of European Justice’s ruling in Data Protection Commissioner v. Facebook Ireland Limited and Maximillian Schrems (colloquially known as Schrems II), the EU-U.S. Privacy Shield has been deemed invalid and companies with U.S. and EU presences have been left without necessary compliance regulations that allow them to legally transfer data internationally. When the Court invalidated the EU-U.S. Privacy Shield, it failed to replace it with a clear alternative. This has created challenges for international businesses and governments as none of the parties know to whom to defer for regulatory compliance inquiries. While on July 10, 2023, the EU Commission and the Biden Administration agreed upon an EU-U.S. Data Protection Framework, it is unlikely that this agreement will be legally binding. Should the Court of Justice of the European Union (CJEU) overturn this framework, all policy proposals must start over. The debacle not only highlights differences in data protection standards and surveillance practices between the two regions but also the inadequate commonplace of international organizations deciding on ‘legal’ frameworks without judicial approval.