In a landmark decision, the EU General Court ruled on Wednesday that the European Commission must pay compensation to a German citizen for breaching its own data protection laws. The court found that the Commission transferred the citizen’s personal data to the United States without adequate safeguards, in violation of the EU’s General Data Protection Regulation (GDPR).
The case stemmed from the individual using the “Sign in with Facebook” option to register for a conference via the EU login page. The court concluded that the Commission’s transfer of the user’s IP address to Meta Platforms in the U.S. was unlawful, as it did not meet the required data protection standards set out by the GDPR. As a result, the Commission was ordered to pay the citizen 400 euros ($412) in damages.
A spokesperson for the European Commission acknowledged the ruling and stated that it would carefully assess the judgment and its implications. This decision marks a significant development in the enforcement of GDPR, a regulation widely considered to be among the most robust data privacy laws globally. Many major companies, including Meta, LinkedIn, and Klarna, have faced heavy fines from the EU for failing to comply with these regulations.