GC - T‑354/22 - Bindl v Commission
EU court orders Commission to pay €400 for data transfer to US.
The European General Court has ordered the European Commission to pay a data subject €400 in non-material damages. This ruling stems from the transfer of personal data, including IP addresses and browser information, to the United States via services like Amazon CloudFront and Meta Platforms Inc. during visits to a Commission website.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Amazon?
Get an email when a new story names Amazon, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe European Commission was ordered to pay damages after its website transferred personal data—including IP addresses and browser fingerprints—to US-based providers Amazon CloudFront and Meta Platforms without a valid legal basis under GDPR. This case highlights how routine use of third-party CDN and analytics services can inadvertently create unlawful international data transfers, even by public institutions. The ruling underscores that embedding external scripts or infrastructure from non-EEA providers constitutes a data transfer requiring explicit legal justification. It matters because any organisation, public or private, can face liability for data flows they may not even be aware of within their own web stack.
What helps against this
How we list vendors- Cloud security posture management (CSPM and CNAPP)
Misconfigured cloud storage and over-permissive roles get caught before they leak.