European Union (EU) Court of Justice has ordered the EU Commission to pay compensation to an internet user for transmitting personal data to the United States.
The Luxembourg judges stated on Wednesday that the commission had created the conditions for the transmission of the user’s IP address to the US company Meta through the “Sign in with Facebook” hyperlink displayed on the “EU Login” website. The commission had committed a “sufficiently qualified infringement” of a norm that aims to grant the individual rights. As the conditions for the non-contractual liability of the Union are fulfilled, the court sentenced the commission to pay the user 400 euros.
The case in question concerns a German resident who accused the commission of violating his right to the protection of his personal data in 2021 and 2022 when he visited the website of the EU’s conference on the future of Europe, which was operated by the commission. He had registered for the “GoGreen” event and used the “EU Login” authentication service of the commission. The commission had transmitted his personal data to recipients in the US upon the website’s call.
Under US law, however, the authorities there could access the data transmitted from the EU, the plaintiff argued. There was no decision by the commission to establish the adequacy of the data protection in the US. Furthermore, the transmission of data to the US on the basis of standard contract clauses without additional measures did not provide sufficient protection.