[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fxxwYIZMdD8049LkbaBfXGRTtmhfgYa4mHlkHc7Y6riI":3},{"article":4,"iocs":46,"watch_terms":51,"solutions":52,"lesson":55},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"25fe1146-c87f-4130-83af-8cab6a951e6d","GC - T‑354\u002F22 - Bindl v Commission","gc-t-354-22-bindl-v-commission-68fe91","← Older revision Revision as of 09:21, 24 June 2026 Line 12: Line 12: |ECLI=ECLI:EU:T:2025:4 |ECLI=ECLI:EU:T:2025:4 |Opinion_Link= |Opinion_Link=CJEU |Judgement_Link=https:\u002F\u002Fcuria.europa.eu\u002Fjuris\u002Fdocument\u002Fdocument.jsf?text=&docid=294090&pageIndex=0&doclang=DE&mode=req&dir=&occ=first&part=1&cid=338866 |Judgement_Link=https:\u002F\u002Fcuria.europa.eu\u002Fjuris\u002Fdocument\u002Fdocument.jsf?text=&docid=294090&pageIndex=0&doclang=DE&mode=req&dir=&occ=first&part=1&cid=338866","The European General Court has ordered the European Commission to pay a data subject €400 in non-material damages. This decision stems from the transfer of the data subject's personal data, including IP address and browser information, to the United States via services like Amazon CloudFront and Meta Platforms Inc. The court found these transfers violated EU GDPR provisions concerning data protection adequacy and transfer mechanisms.","European General Court orders Commission to pay €400 for data transfer to US.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=GC_-_T%E2%80%91354\u002F22_-_Bindl_v_Commission&diff=51982&oldid=46606","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F8\u002F87\u002FCjeulogo.png","2026-06-24T09:21:21+00:00","2026-06-24T10:00:13.856115+00:00",7,[17,20,22],{"name":18,"type":19},"Amazon","vendor",{"name":21,"type":19},"Meta Platforms Inc.",{"name":23,"type":24},"Amazon CloudFront","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":25,"icon":27,"name":28,"slug":29},null,"Policy","policy",[31,36,41],{"category":32},{"id":33,"icon":27,"name":34,"slug":35},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":37},{"id":38,"icon":27,"name":39,"slug":40},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":42},{"id":43,"icon":27,"name":44,"slug":45},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[47],{"type":48,"value":49,"context":50},"url","https:\u002F\u002Fcuria.europa.eu\u002Fjuris\u002Fdocument\u002Fdocument.jsf?text=&docid=294090&pageIndex=0&doclang=DE&mode=req&dir=&occ=first&part=1&cid=338866","Judgement link for GC - T‑354\u002F22 - Bindl v Commission",[18,21,23],{"controls":53,"vendors":54},[],[],{"slug":56,"title":57,"body":58,"framework_refs":59,"framework_notes":71},"eu-court-orders-commission-to-pay-400-for-unlawful-us-data-transfers-via-third-party-services","EU Court Orders Commission to Pay €400 for Unlawful US Data Transfers via Third-Party Services","The European Commission was found liable for transferring a data subject's personal data — including IP address and browser metadata — to the United States through third-party services Amazon CloudFront and Meta Platforms without adequate transfer mechanisms in place. This case highlights that even passive or incidental data flows triggered by embedded third-party tools can constitute GDPR violations. Organizations often overlook the data transfer implications of using CDNs, analytics, or social media plugins on their platforms. The ruling reinforces that public bodies and private organizations alike bear responsibility for vetting every third-party service that processes personal data on their behalf. Failing to establish lawful transfer mechanisms exposes organizations to reputational, financial, and legal consequences.",[60,61,62,63,64,65,66,67,68,69,70],"GDPR Article 44 – General principle for transfers","GDPR Article 45 – Transfers on the basis of an adequacy decision","GDPR Article 46 – Transfers subject to appropriate safeguards (SCCs)","GDPR Article 28 – Processor obligations","GDPR Article 35 – Data Protection Impact Assessment","NIST SP 800-53 PT-7 (Specific Categories of PII)","NIST SP 800-53 SA-9 (External System Services)","CIS Control 3 – Data Protection","CIS Control 15 – Service Provider Management","ISO\u002FIEC 27701 – Privacy Information Management","ITIL Service Design – Supplier Management",{}]