On Wednesday, 8 January 2025, the General Court of the EU Court of Justice issued a landmark judgment in case Case T-354/22 after it ruled that the European Commission had "committed a sufficiently serious breach of a rule of law that is intended to confer rights on individuals." The General Court found that the Commission had transferred the personal data of an EU citizen to the US during the period after the Court of Justice of the EU (CJEU) struck down the EU-US Privacy Shield and before the adoption of the EU-US Data Privacy Framework (DPF), a violation of Regulation 2018/1725 covering EU institutions (commonly referred to as the EUDPR).
The transfer of the claimant's IP address, browser and terminal information occurred after the Commission implemented the "Sign in with Facebook" feature on an EU webpage to allow users to login to a conference. The Court ordered the Commission to pay €400 in damages to the claimant. While the Commission may still appeal the decision to the CJEU, the ruling could have significant implications for future data protection litigation and representative actions.
Additional legal analysis by the IAPP.
What is this page?
You are reading a summary article on the Privacy Newsfeed, a free resource for DPOs and other professionals with privacy or data protection responsibilities helping them stay informed of industry news all in one place. The information here is a brief snippet relating to a single piece of original content or several articles about a common topic or thread. The main contributor is listed in the top left-hand corner, just beneath the article title.
The Privacy Newsfeed monitors over 300 global publications, of which more than 5,750 summary articles have been posted to the online archive dating back to the beginning of 2020. A weekly roundup is available by email every Friday.
