The EU Fined Itself for Breaking Its Own Data Privacy Law

The European Union itself has investigated and found… real wrongdoing! For the first time, the EU has breached its own privacy rules established by the General Data Protection Regulation (GDPR) and has to pay fines, Judgment by the EU General Court.

The victim of the EU’s blatant disregard for the law is a German citizen who used the “Sign in with Facebook” option when registering for the conference through the European Commission’s webpage. When the user clicks that button, data about their device, browser and IP address is transferred through a content delivery network operated by Amazon Web Services and eventually finds its way to servers operated by Facebook’s parent company Meta Platform in the United States. The court determined that this data transfer occurred without proper protection, amounting to a violation of GDPR rules, and ordered the person who brought the case to pay a fine of €400 (about $412) directly.

GDPR, which is why every website now Ask you if you want to accept cookiesThe technology has been a thorn in the side of companies since it was first implemented in 2018 A set of strict data privacy rules designed to control the amount of personal data companies can collect from users and how individuals can further control their information. Big tech firms—particularly Meta—have access to and use of much larger fines.

Just last year, Meta got it $1.3 billion in fines for failing to adequately protect European users’ data from American intelligence agencies when transferring data to US servers. Previously, Meta got hit with one $417 million in fines Under the GDPR rules for violating the privacy of minor users on Instagram $232 million For failing to transparently disclose how WhatsApp processes data. Meta isn’t alone in getting this slightly pricey wrist slapper though (Amazon has one of its own). $887 million in fines In 2021, for example), it’s fitting that it was a Facebook login option that got the EU into hot water with itself.

The implementation of GDPR has been a bit of a mixed bag. It has undoubtedly grabbed some headlines with large fines aimed at Silicon Valley giants. But enforcement can take forever—even the EU’s first self-imposed penalty process for violating an individual’s privacy took more than two years. More than three in four have data protection authorities complaint There is plenty of evidence to suggest a lack of budget and manpower to track violations, and a list of byzantine laws Not much has actually been done To curb the invasive practices of surveillance capitalism. The EU has some work to do. Maybe start following your own rules.