Month: August 2025

The issue of transfers of personal data outside the European Economic Area remains not only very topical, but also very sensitive. The decision handed down by the Court of Justice of the European Union on 8 January 2025 illustrates this perfectly. The case under consideration was between a German citizen and the European Commission. This case (T-354/22) questions the lawfulness of the transfers of personal data to third countries carried out by the Commission and recalls the obligation of the European institutions to guarantee a level of protection in accordance with the standards of the GDPR and Regulation 2018/1725.

1. The case in brief. Bindl, after accessing the website of the Conference on the Future of Europe, found that connections with third parties, including Amazon Web Services (AWS) and Meta Platforms Inc. (Facebook), had been activated, raising questions about possible data transfers outside the EU. In order to register for an event on this site, he used the authentication option via Facebook (EU Login), resulting in a transfer of his IP address and other information to Meta’s servers in the United States. Mr Bindl, a German citizen with a keen interest in IT and data protection issues, asked the Commission for clarification, but the Commission was slow to respond. The case concerned three points: the cancellation of the data transfers, the recognition of a failure by the Commission and a claim for compensation for moral damage.
2. Legal teaching. The General Court dismissed the applications for annulment and for recognition of a failure to act, holding that the transfers at issue did not constitute challengeable acts within the meaning of Article 263 TFEU. However, regarding the question of the Commission’s liability, the General Court held that the transfer of personal data to the United States did indeed constitute a violation of Article 46 of the GDPR, in the absence of sufficient safeguards. The General Court thus ordered the European Commission to pay Mr Bindl the sum of EUR 400 in compensation for the damage suffered.

This judgment is based on three fundamental elements:

• • The sufficiently serious breach of EU law: The Commission failed to fulfil its obligations by facilitating the transfer of data via the Facebook hyperlink without providing safeguards in accordance with the requirements of the GDPR.
  • The existence of moral damage: The uncertainty about the security of the data and the lack of transparency of the Commission placed Mr Bindl in a situation of legal uncertainty.
  • A direct causal link: The display of the Facebook hyperlink on EU Login immediately led to the transmission of the data, which was attributable to the Commission.

3. Impact and perspectives. This judgment illustrates the rigour of judicial review in data protection and highlights the legal risks associated with the use of third-party services for user authentication. It also underlines the responsibility of the European institutions in the implementation of online connection devices and the need to provide safeguards in line with the requirements of the GDPR.

This ruling sets an important precedent, especially for public entities using US services involving data transfers outside the EU. He points out that the presence of a simple hyperlink leading to an external service may be enough to engage the liability of an institution in the event of a non-compliant data transfer. It also shows that our institutions are in no way exempt from the regulations to which they themselves have given birth; Compliance and legal rigour are required, including in the upper echelons of our democratic institutions.

Transferring data outside the European Economic Area in a GDPR-compliant manner remains a challenge today. In this respect, we welcome the recent initiative of the CNIL, which has published a guide on the impact assessments of data transfers, intended to support organizations carrying out such transfers.

See more articles from our member firm in Belgium, Philippe & Partners.