EU Court Fines European Commission Over Data Privacy Breach

EU Commission Ordered to Pay Damages for Data Protection Breach

A ruling by a high-level court mandates that the European Union’s primary executive body provide €400 (approximately $410) in compensation to a German national.

This payment is a consequence of a violation of the EU’s own data protection regulations, as stated by the EU General Court in an official announcement.

Details of the Case

The court determined that the European Commission infringed upon the citizen’s rights by transmitting certain personal data to the United States without implementing adequate protective measures.

The situation arose when the German citizen registered for a conference organized by the European Commission.

He utilized the “Sign in with Facebook” feature available on the conference’s website.

However, the citizen alleged that details such as his IP address, browser information, and device specifics were subsequently transferred to US-based corporations.

Specifically, these companies included Amazon, the host of the conference website, and Meta, the parent company of Facebook.

The citizen maintained that this data transfer constituted a breach of his rights under the EU’s data privacy framework.

Court’s Decision

The EU General Court’s ruling, delivered on Wednesday, affirmed that the European Commission committed a “sufficiently serious breach” of regulations applicable across the 27 EU member states.

According to Reuters, which initially reported on the case, this financial penalty represents a first-time occurrence for the European Commission.

Significance of the Ruling

The EU’s data protection regulations, commonly referred to as GDPR, are globally recognized as among the most stringent data privacy laws.

Organizations found in violation of these rules can face substantial fines, potentially reaching up to 4% of their annual global revenue.

This case underscores the importance of adhering to GDPR guidelines when processing and transferring personal data, even within the EU institutions themselves.

The ruling serves as a precedent, demonstrating that even the EU Commission is subject to the same data protection standards as other organizations.