GC - T‑354/22 - Bindl v Commission
European General Court orders Commission to pay €400 for data transfer to US.
The European General Court has ordered the European Commission to pay a data subject €400 in non-material damages. This decision stems from the transfer of the data subject's personal data, including IP address and browser information, to the United States via services like Amazon CloudFront and Meta Platforms Inc. The court found these transfers violated EU GDPR provisions concerning data protection adequacy and transfer mechanisms.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Amazon?
Get an email when a new story names Amazon, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe European Commission was found liable for transferring a data subject's personal data — including IP address and browser metadata — to the United States through third-party services Amazon CloudFront and Meta Platforms without adequate transfer mechanisms in place. This case highlights that even passive or incidental data flows triggered by embedded third-party tools can constitute GDPR violations. Organizations often overlook the data transfer implications of using CDNs, analytics, or social media plugins on their platforms. The ruling reinforces that public bodies and private organizations alike bear responsibility for vetting every third-party service that processes personal data on their behalf. Failing to establish lawful transfer mechanisms exposes organizations to reputational, financial, and legal consequences.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- url — https://curia.europa.eu/juris/document/document.jsf?text=&docid=294090&pageIndex=0&doclang=DE&mode=req&dir=&occ=first&part=1&cid=338866