EU data transfer ruling: European commission fined for US data breach

In a judgment handed down on 8^th January 2025 by the General Court of the European Union (Case no T-354/22), the EU Commission was ordered to pay €400 in damages to a German individual for sending his personal data to America without ensuring that appropriate safeguards were in place.

When did this happen? A timeline of the EU data transfer ruling

The incident occurred after the Privacy Shield was declared invalid by the Court of Justice of the European Union in July 2020 but before the EU-US Data Privacy Shield was introduced in July 2023. Therefore, as there was no adequacy decision in place in respect of transfers of personal data from the EU to the US at the material time, the European Commission should have implemented alternative safeguards for transfers of personal data to the US but failed to do so in this case.

How was personal data transferred to the US?

The data subject visited the events registration page on the website of the “Conference on the future of Europe”, (which is managed by the European Commission) and he registered for an event called “Go Green”.  The data subject claimed that, as a result of this, his personal data was transferred to the US on three occasions, as set out below.

• The first occasion arose when the data subject visited the website in question on 30^th March 2022, as the website was supported by Amazon CloudFront which sent the data subject’s IP address and browser and terminal information from the EU to the US.
• The second occasion also arose on 30^th March 2022, when the data subject chose to register for the event referred to above by using the “sign-in with Facebook” hyperlink displayed on the website. The data subject claimed that, as a result of this, his personal data was transferred from the EU to the US.
• The third occasion arose on 8^th June 2022, when the data subject visited the website in question for a second time and the data subject’s IP address and browser and terminal information were, again, transferred from the EU to the US as a result of the Commission using Amazon CloudFront to support the website.

Also, on 1^st April 2022, the data subject sent a request to the Commission for access to his personal data and claimed that the response was insufficient. He also claimed that the Commission’s privacy notice contained no details on the transfer of data to the US and therefore was not transparent.

What legal framework applies to this case?

The relevant law in this case is not the GDPR but the data protection rules that apply to Union bodies only, namely Regulation (EU) 2018/1725 (“EUDPR”).

What compensation did the data subject request?

The data subject requested the following:

• An annulment of the transfer of his personal data (i.e a declaration that the transfer was not legal).
• €400 in non-material damages due to his personal data being transferred from the EU to the US because, at the time of the transfer, the US did not provide an adequate level of protection for personal data and no other safeguards were implemented to protect his personal data.
• €800 in non-material damages for an infringement of his right to access to his personal data and for an infringement of the transparency principle.

General Court ruling: What was decided?

• Annulment

The application for annulment was dismissed on the grounds that the transfers in question were not likely to have legal binding effects and would not result in the data subject changing his legal position.

• €400 for non-material damages for the transfer of data without adequate safeguards

With regard to the alleged transfers of personal data from the EU to the US, the court found that:

• For the first transfer (visiting the website in question on 30^th March 2022), the data remained within the EU.
• For the second transfer (using the Facebook login), the court found that by displaying the “sign-in with Facebook” hyperlink, the Commission, created a situation where personal data would be transferred to the US. However, as there was no adequacy decision in place at the time and no other safeguards for transferring personal data had been implemented by the European Commission, the court found that this transfer was in contravention of the EUDPR and supported this part of the claim, awarding €400 for non-material damage.
• For the third transfer (visiting the website in question on 8^th June 2022), the court found that the data was transferred from the EU to the US. However, the court also found that this only occurred because the data subject spoofed his location to make it look as if he was located in the US. Therefore, the transfer only occurred as a result of the data subject’s actions, rather than as a result of the failings of the European Commission.
• €800 for non-material damages for infringement of the right of access and transparency

The only failing the court found in relation to this element of the claim was that the European Commission responded outside the one-month time limit required under the relevant law but, as this was not part of the data subject’s claim, no award was made.

What are the wider implications of this EU data transfer ruling?

Whilst some may argue that this is a significant judgment, it is important to note that:

• The relevant law in this case not the GDPR but the EUDPR which applies to Union bodies only, and as such, this case does not set a precedent for cases decided in relation to the GDPR.
• The case was decided by the General Court, which is the European’s Court of first instance, which means that the European Court of Justice is not obligated to follow the decision.
• It is unclear how the sum of €400 for the non-material damage was arrived at.
• The European Commission has indicated that it will “carefully study” the judgment, which could suggest that it may submit an appeal.
• Since the EU-US Data Privacy Framework is now in place, we would see a different decision if the same thing happened today.

Does this ruling impact GDPR international transfers?

Therefore, in view of the above points, the decision in this case would not be directly applicable to situations in which personal data is transferred from the EU to the US under the GDPR and, as the General Court is the lowest court, any decisions it makes would not need to be followed by the higher courts, such as the European Court of Justice. In any event, because of the implementation of the EU-US Data Privacy Framework, it is much less likely that any such cases would reach the courts now.

Next steps: What this case means for data protection compliance

Whilst this case is interesting, the decision is limited to its particular facts and the legal framework which was applicable at the material time. As such, we don’t anticipate that it will have huge implications for the issue of international transfers under the GDPR, although time will tell!

What the case also highlights, is the importance of transparency and ensuring that organisations communicate how they will use personal data and where it may be transferred to.

Support with international data transfers

If you need help with your international transfers or any other data protection matter such as reviewing your privacy notices, please get in touch, we would be glad to assist.

​