Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteThe headline that the “EU fined itself” is catchy but legally imprecise. In Bindl v European Commission (Case T-354/22), decided on January 8, 2025, the EU General Court ordered the European Commission to pay German citizen Thomas Bindl €400 in compensation after finding that an EU-managed website facilitated the transfer of his IP address to Meta in the United States without the required data-transfer safeguards.
The award was damages for non-material harm—not an administrative GDPR fine imposed on the EU as a whole.
As an Amazon Associate I earn from qualifying purchases.
What happened
Bindl used the Commission-managed Conference on the Future of Europe website on March 30, 2022, to register for a “GoGreen” event. The registration process used the Commission’s EU Login service and offered a “Sign in with Facebook” option.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →The General Court found that the Facebook link created the conditions for Bindl’s IP address to be transmitted to Meta Platforms, Inc., a company established in the United States. In this legal context, the IP address was personal data.
#1 Best Overall
The court held that the relevant transfer was attributable to the Commission because of the way the link was presented and operated. The fact that the visitor chose to use the Facebook login route did not, by itself, remove the Commission’s responsibility for facilitating the resulting data flow.
The Court of Justice press release and the full judgment describe the finding.
Why “the EU fined itself” is not quite right
Three separate points are easily compressed into the misleading headline:
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →- The defendant was the European Commission. The ruling was not against every EU institution collectively.
- The payment was compensation. It was awarded to Bindl for damage he suffered, rather than imposed as a regulatory penalty designed to punish or deter an organisation.
- The ruling came from the General Court. It was not a decision of the Court of Justice acting as the EU’s top appellate court.
A legally accurate summary is: the EU General Court ordered the European Commission to pay €400 after finding that it facilitated an unlawful transfer of a visitor’s IP address to Meta in the United States.
Which data-protection law applied?
The directly relevant law was Regulation (EU) 2018/1725, which governs the processing of personal data by EU institutions, bodies, offices and agencies. It is the EU institutions’ own data-protection framework.
Its principles closely correspond to those found in the General Data Protection Regulation, or GDPR. But it is inaccurate to describe this judgment simply as a finding that the Commission “breached the GDPR.” The court applied Regulation 2018/1725 and its rules on transfers of personal data to countries outside the EU.
Why the Meta transfer was unlawful
For the transfer at issue on March 30, 2022, the court noted that there was no Commission adequacy decision finding that the United States provided an adequate level of protection for EU citizens’ personal data.
Recommended Free Tools
That did not mean that every transfer to the United States was automatically impossible. Transfers can potentially rely on other legal safeguards, such as appropriate contractual safeguards. The problem in this case was that the Commission had neither demonstrated nor claimed an applicable safeguard for the specific transfer to Meta.
The court therefore found a sufficiently serious breach of rules intended to protect individuals’ rights. The date matters: the judgment’s assessment concerned the legal and factual circumstances existing in March 2022. It should not be presented as an undated statement that describes every aspect of US-EU data-transfer law in September 2026.
The Amazon CloudFront allegation was different
The judgment did not hold that all data handled by a US-owned technology provider was unlawfully transferred to the United States.
Bindl also challenged data flows involving Amazon CloudFront. The court rejected that part of the claim where the relevant connection was shown to have gone to a server in Munich, Germany. The Commission’s arrangements required data to remain in Europe at rest and in transit.
A separate technical routing circumstance made the user appear to be located in the United States, but the court did not treat that alone as proof of an unlawful transfer attributable to the Commission. Nor did the mere possibility that US authorities might access data establish that a transfer to a third-country recipient had occurred.
This distinction is important for organisations using multinational cloud providers:
- US ownership is not identical to a transfer to the United States.
- European storage is not automatically unlawful.
- Actual destination, recipient, routing, contractual arrangements and safeguards all matter.
Why the court awarded €400
To establish EU non-contractual liability, Bindl needed to show:
- a sufficiently serious breach of a rule intended to confer rights on individuals;
- actual damage; and
- a sufficiently direct causal link between the breach and the damage.
The court found that the transfer caused non-material damage. Bindl was placed in a position of uncertainty about the processing of his personal data, including his IP address, after it was sent to Meta in the United States without the required safeguard being demonstrated.
The court assessed that harm at €400. This was an equitable assessment of the damage in this particular case. It was not a standard tariff that every person can claim after an unlawful data transfer.
Bindl did not win every part of the case
The ruling was only a partial victory. The court:
- awarded €400 for the unlawful transfer connected with the Facebook login;
- rejected the damages claim concerning an alleged infringement of his right of access to information;
- dismissed the claim seeking annulment of the transfers as inadmissible;
- found no need to rule on the failure-to-act claim because the relevant circumstances had changed; and
- ordered the Commission to bear its own costs and half of Bindl’s costs.
The court therefore did not award €400 for the entire lawsuit or for every alleged data-protection violation.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What the ruling means for websites and login services
The practical lesson extends beyond EU institutions. A website operator cannot necessarily avoid responsibility by calling a third-party tool “optional” or by saying that the visitor clicked the link.
When a site embeds, presents or facilitates a third-party authentication, analytics or tracking mechanism, the operator should understand:
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11- What data is sent. This may include an IP address, browser information or device details.
- When it is sent. A request may occur when a page loads, when a link is clicked or when authentication begins.
- Where it goes. The provider’s corporate headquarters, hosting location, server destination and onward-access arrangements are not necessarily the same thing.
- Who receives or controls it. The operator’s role and the third party’s role need to be assessed rather than assumed.
- Which transfer mechanism applies. If data leaves the European Economic Area, the operator must identify the applicable legal basis and safeguards.
The case is especially relevant to social-login buttons. A button can have data-protection consequences before a user has completed an account-registration process, depending on how the technology works and when information is transmitted.
What the case does not mean
- It does not establish a blanket ban on US cloud or technology providers.
- It does not establish that every visit to an EU website involved an unlawful US transfer.
- It does not establish that a US parent company automatically turns European data storage into a transfer to the United States.
- It does not create an automatic €400 payment for everyone affected by an unlawful transfer.
- It does not mean that the Commission was fined under the ordinary GDPR enforcement process.
Which court ruled, and what about appeals?
The judgment was delivered by the General Court of the European Union, Sixth Chamber, Extended Composition, on January 8, 2025. The case was Thomas Bindl v European Commission, Case T-354/22.
The General Court is distinct from the Court of Justice of the European Union, which hears appeals on points of law. The official EUR-Lex case record lists appeals under C-206/25 P and C-211/25 P. The existence of those listed appeals means the General Court judgment should not be described as necessarily being the final word without checking the relevant appellate record.
The bottom line
The irony is real, but the legal outcome is narrower than the headline suggests. The EU General Court enforced the EU institutions’ data-protection rules against the European Commission and awarded one visitor €400 after a Facebook login link facilitated the transfer of his IP address to Meta in the United States.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
It was an individual damages award over a specific data-transfer mechanism—not a blanket ruling against US technology providers, and not technically a fine imposed on “the EU.”
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
