[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f9RkGx_uTT5l98vEmWfDMw3OeV-aJOfTMQQd49I3K6VA":3},{"article":4,"iocs":48,"watch_terms":49,"solutions":50,"lesson":82},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"e52f0e88-21bf-42d4-93ee-1016edbe4a43","GC - T‑354\u002F22 - Bindl v Commission","gc-t-354-22-bindl-v-commission-89fe9e","← Older revision Revision as of 11:48, 8 July 2026 Line 58: Line 58: |Initial_Contributor=ao |Initial_Contributor=ao | | }} |Original_Source_Name_1=curia.europa|Original_Source_Link_1=https:\u002F\u002Finfocuria.curia.europa.eu\u002Ftabs\u002Fdocument\u002FT\u002F2022\u002FT-0354-22-00000000RD-01-P-01\u002FARRET\u002F294090-EN-1-html}} The European General Court ordered the European Commission to pay a data subject €400 in non-material damages due to the transfer of personal data to the USA following two visits to one of the Commission’s websites. The European General Court ordered the European Commission to pay a data subject €400 in non-material damages due to the transfer of personal data to the USA following two visits to one of the Commission’s websites.","The European General Court has ordered the European Commission to pay a data subject €400 in non-material damages. This ruling stems from the transfer of personal data, including IP addresses and browser information, to the United States via services like Amazon CloudFront and Meta Platforms Inc. during visits to a Commission website.","EU court orders Commission to pay €400 for data transfer to US.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=GC_-_T%E2%80%91354\u002F22_-_Bindl_v_Commission&diff=52123&oldid=51982","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F8\u002F87\u002FCjeulogo.png","2026-07-08T11:48:41+00:00","2026-07-08T12:00:33.27415+00:00",7,[17,20,22],{"name":18,"type":19},"Amazon","vendor",{"name":21,"type":19},"Meta Platforms Inc.",{"name":23,"type":24},"Amazon CloudFront","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":25,"icon":27,"name":28,"slug":29},null,"Policy","policy",[31,36,41,43],{"category":32},{"id":33,"icon":27,"name":34,"slug":35},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":37},{"id":38,"icon":27,"name":39,"slug":40},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":42},{"id":25,"icon":27,"name":28,"slug":29},{"category":44},{"id":45,"icon":27,"name":46,"slug":47},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18,21,23],{"controls":51,"vendors":81},[52],{"slug":53,"name":54,"problem":55,"products":56},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",[57,65,73],{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":62,"url":63,"description":64},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-cloud","Cortex Cloud","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcloud","Cloud security platform covering posture management and runtime protection.",{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-cloud","Microsoft Defender for Cloud","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fcloud-security\u002Fmicrosoft-defender-cloud","Cloud posture management and workload protection for Azure, AWS and Google Cloud.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"wiz","Wiz","\u002Fvendor-logos\u002Fwiz.png","wiz-cloud","Wiz Cloud","https:\u002F\u002Fwww.wiz.io\u002Fplatform\u002Fwiz-cloud","Agentless cloud security posture and attack path analysis across major cloud providers.",[],{"slug":83,"title":84,"body":85,"framework_refs":86,"framework_notes":97},"eu-commission-fined-for-unlawful-data-transfers-to-us-via-third-party-services","EU Commission Fined for Unlawful Data Transfers to US via Third-Party Services","The European Commission was ordered to pay damages after its website transferred personal data—including IP addresses and browser fingerprints—to US-based providers Amazon CloudFront and Meta Platforms without a valid legal basis under GDPR. This case highlights how routine use of third-party CDN and analytics services can inadvertently create unlawful international data transfers, even by public institutions. The ruling underscores that embedding external scripts or infrastructure from non-EEA providers constitutes a data transfer requiring explicit legal justification. It matters because any organisation, public or private, can face liability for data flows they may not even be aware of within their own web stack.",[87,88,89,90,91,92,93,94,95,96],"GDPR Article 44 – General principle for transfers","GDPR Article 46 – Transfers subject to appropriate safeguards","GDPR Article 82 – Right to compensation and liability","GDPR Article 25 – Data protection by design and by default","NIST SP 800-53 SA-9 (External Information System Services)","NIST SP 800-53 CA-3 (System Interconnections)","CIS Control 4 – Secure Configuration of Enterprise Assets and Software","CIS Control 15 – Service Provider Management","EDPB Recommendations 01\u002F2020 on measures that supplement transfer tools","ITIL Service Design – Supplier Management",{}]