EU court orders commission to pay damages over Meta data transfer breach
Court rules EU commission violated data protection laws by enabling user data transfer to Meta through Facebook login feature.
Two days ago, on January 8, 2025, the General Court of the European Union ordered the European Commission to pay damages to a German citizen over unlawful personal data transfers to the United States, marking a significant development in international data protection enforcement.
According to court documents from Case T-354/22, the incident occurred when Thomas Bindl, a German resident, registered for a 'GoGreen' event through the Commission's 'Conference on the Future of Europe' website in March 2022. The Commission's implementation of the 'Sign in with Facebook' feature resulted in the transfer of his IP address and browser information to Meta Platforms in the United States.
The General Court determined that at the time of the data transfer on March 30, 2022, no Commission decision existed confirming adequate data protection levels for EU citizens' personal data in the United States. The Court noted that the Commission failed to demonstrate any appropriate safeguards, such as standard data protection clauses or contractual provisions, to protect the transferred data.
Court documents reveal that the login interface was "entirely governed by the general terms and conditions of the Facebook platform," without additional protective measures. This arrangement created conditions that enabled the transmission of personal data to Meta Platforms, constituting a breach of EU data protection regulations.
The judgment highlighted a critical technical aspect of the case involving Amazon Web Services (AWS). While some data transfers occurred through AWS CloudFront servers in Munich, Germany, the routing mechanism occasionally directed traffic to U.S. servers due to technical configurations. However, the Court dismissed claims related to these AWS transfers, focusing instead on the Facebook login implementation.
The legal basis for the ruling stems from Chapter V of Regulation (EU) 2018/1725, which governs the protection of natural persons regarding personal data processing by EU institutions. The Court found that the Commission's failure to implement appropriate safeguards constituted a "sufficiently serious breach of a rule of law intended to confer rights on individuals."
In its decision, the Court awarded Bindl €400 in compensation for non-material damages, acknowledging that he "found himself in a position of some uncertainty as regards the processing of his personal data." The ruling established a direct causal link between the Commission's infringement and the damages sustained.
The case addressed broader implications regarding U.S. surveillance capabilities. The plaintiff argued that U.S. security and intelligence services could potentially access transferred data, citing inadequate protection levels in the United States. These concerns were particularly relevant given the absence of an adequacy decision for U.S. data transfers at the time.
The Court dismissed several other aspects of the case, including claims for annulment and allegations regarding Amazon CloudFront data transfers. The final ruling ordered the Commission to bear its own costs and pay half of the plaintiff's legal expenses.
This judgment establishes precedent regarding institutional accountability for third-country data transfers and reinforces the requirement for concrete safeguards when EU institutions enable data flows to non-EU countries. The ruling particularly emphasizes the responsibility of EU institutions to ensure compliance with data protection regulations when implementing third-party authentication services.
The case highlights technical complexities in modern data transfers, including the role of content delivery networks and authentication systems in international data flows. It demonstrates how seemingly simple features like social media login buttons can create significant data protection implications requiring careful legal consideration.
Legal experts note that this ruling may influence future implementations of third-party authentication systems across EU institutional websites and potentially impact how organizations approach social media integration in their digital services.
The judgment allows for an appeal on points of law before the Court of Justice within two months and ten days of notification. The Commission has not yet indicated whether it plans to appeal the decision.