The European Commission is to pay EUR 400 in compensation to a German citizen for making the “Log in with Facebook” option available on its website in 2022, the General Court of the European Union ruled on Wednesday. In this way, personal data reached a US company, which did not guarantee their proper protection at that time.
The judgment issued by the General Court of the European Union, a lower instance of the Court of Justice of the EU in Luxembourg, is not final. The EC will be able to appeal against it to CJEU. A citizen sued the European Commission Germanwho found that his right to personal data protection had been violated. It is not only about transferring his data to Meta – the owner of Facebook, but also to the American company Amazon Web Services, which is the operator of the content delivery network called Amazon CloudFront. The EC used the services of both companies in 2021 and 2022 to operate the website of the Conference on the Future of Europe – an initiative that was intended to engage EU citizens in the discussion on European integration. As we read in the announcement, the German registered to participate in one of the events by selecting the offered option using his Facebook account – via the “Log in with Facebook” hyperlink. In this way, his data was transferred to Meta. The man claimed that the European Commission exposed him to the risk of access to his data by the American intelligence and security services.
Data ultimately remained in Europe
An EU court rejected a claim for damages in relation to data transferred via Amazon CloudFront because it ultimately ended up on a server in Munich and not in the United States. The EC concluded an agreement with Amazon CloudFront guaranteeing that the data of European citizens will remain in Europe. However, he admitted that he was right about the Meta demand. He found that the “log in with Facebook” hyperlink made it possible to transmit the IP address of a German citizen to Facebook. “Meanwhile, at the time of this transfer, i.e. on March 30, 2022, there was no EC decision stating that the United States ensures an adequate level of protection of the personal data of Union citizens,” the EU General Court emphasized. This situation changed in July 2023, when the EC adopted a decision in which it found that United States ensure an adequate level of protection of personal data, comparable to that in the EU, when it is transferred to American companies.
Main photo source: Shutterstock