EU fines European Commission for violating GDPR!

On January 8, 2025, the EU General Court issued an unexpected verdict. The court penalised the European Commission €400 for violating its own data protection standards.

It all started when a German individual registered for a meeting organised by the European Commission. The European Commission's website offered a variety of standard sign-in choices, including "Sign in with Facebook," which the citizen used to sign in and enrol for the conference. However, during the sign-in process, some of their personal information, including as their IP address and browser details, was sent to Meta Platforms, the parent company of Facebook, based in the United States.

The EU Court determined that the European Commission did not comply with the General Data Protection Regulation (GDPR), a statute aimed at protecting EU individuals' personal data. According to the GDPR, any transfer of personal data outside the EU must have rigorous safeguards to protect people's privacy. During the sign-in procedure, the Commission failed to demonstrate that it had taken any necessary safeguards to secure the individual's data when it was transferred to the United States, which is a major infringement of the GDPR.

Of course, the fee is tiny in comparison to the millions and billions of euros that the EU court has punished major tech for failing GDPR compliance in recent years. Amazon was fined €746 million in July 2021 for using personal data without proper consent; Instagram was fined €405 million in September 2021; and WhatsApp was fined €225 million in September 2021 for failing to offer transparent information about data processing.

Due to severe rules such as the GDPR and the recently implemented Digital Markets Act (DMA), many software businesses have begun postponing the release of new features in the European Union, as assessing the goods for compliance typically takes additional time.

The European Commission has acknowledged the court's verdict and intends to analyse it for future procedures.