The European Commission has been ordered to pay €400 in damages to a German citizen after breaching EU data protection laws by improperly transferring his personal data to the United States, in a landmark ruling by the EU General Court.

The case centred on the Commission's use of a "Sign in with Facebook" feature on its EU Login webpage, which was used by the individual to register for a "GoGreen" event on the Conference on the Future of Europe website in March 2022.

The court found that by displaying the Facebook login option, the Commission "created the conditions for the transmission" of the user's IP address to Meta Platforms in the United States, at a time when there was no agreement in place ensuring adequate protection of EU citizens' personal data.

"The Commission neither demonstrated nor claimed that there was an appropriate safeguard, in particular a standard data protection clause or contractual clause," the court stated in its judgment. The displaying of the Facebook login option was instead "entirely governed by the general terms and conditions of the Facebook platform."

The ruling marks the first time the Commission has been found liable for breaching the strict data protection standards it enforces on companies and organisations across Europe. The court determined that this constituted a "sufficiently serious breach of a rule of law intended to confer rights on individuals."

While the €400 compensation was modest, the case sets an important precedent for holding EU institutions accountable under their own data protection regulations. The individual had claimed this amount for "non-material damage" after finding himself "in a position of some uncertainty as regards the processing of his personal data."

The court dismissed other aspects of the case, including claims related to data transfers through Amazon Web Services' CloudFront content delivery network, which was found to have kept the data within Europe as required.

The ruling can be appealed to the EU Court of Justice within two months and ten days of the judgment.

---