EU Fines Itself Over Breach of Its Own Data Protection Law

On January 8, 2025, the EU’s general court ruled against the European Commission for failing to comply with its own General Data Protection Regulation (GDPR). As a result, the European Commission must pay €400 for damages to the affected party, a German citizen named Thomas Bindl.

Bindl claims that the breach took place in 2022 when he registered for the “Conference on the Future of Europe” using the Commission’s EU Login authentication service. He then proceeded to select the “sign in with Facebook” option, which allegedly caused his personal data, including his IP address, to be sent to the US through Amazon’s content delivery network Amazon CloudFront. The data then ended up on the servers of Facebook’s parent company, Meta.

At the time of the claim, the European Commission itself recognized that the United States did not meet an adequate level of protection for the information of EU citizens. According to the court, by hosting the “Sign in with Facebook” link on the EU’s page, the commission created the necessary conditions for the transfer of his personal data to Facebook and was therefore liable for damages.

The court declared in a press document, “The General Court finds that the Commission committed a sufficiently serious breach of a rule of law that is intended to confer rights on individuals.”

“The individual concerned suffered non-material damage, in that he found himself in a position of some uncertainty as regards the processing of his personal data, […] There is, moreover, a sufficiently direct causal link between the Commission’s infringement and the nonmaterial damage sustained by the individual concerned,” the document continues.

The plaintiff also requested the annulment of the transfer of his personal data (i.e. that the commission take action to remove his personal information from Meta’s servers), and an additional €800 in damages from an alleged infringement on his right to access that information. The court denied both requests.

The GDPR is considered one of the most comprehensive and stringent data protection laws in the world and has recently served as the bedrock for substantial fines to companies like Meta and OpenAI over their lax privacy policies.