The European Commission has been sued: A lawsuit against the European Commission is likely in response to claims that it is transferring personal information about European citizens to the United States in violation of the EU’s own data protection laws.

Background

In the historic Schrems II decision from two years ago, the EU Court of Justice declared cross-border data transfers to be unlawful, establishing how the EU’s General Data Protection Regulation will be interpreted.
It was determined that the American jurisdiction lacked proper data protection regulations since US intelligence services might access the personal information of EU citizens without a court order.

The EU institutions are subject to a different rule than the GDPR, but the litigation is anticipated to make the Schrems II decision applicable to them as well.

The European Commission Sued: Case Law

A German citizen sued the European Commission, alleging that it’s illegally transferring data and withholding too much information about its data processing procedures.

Thomas Bindl, the founder of the organization backing the plaintiff in the case, claims, “The lawsuit against the European Commission is a signal for data protection in Europe,”

The dispute concerns the Conference of the Future of Europe website, a gathering designed to involve EU citizens in choosing the future of the union and its member states.

The website is hosted by Amazon Web Services; thus, registering for the event, personal information such as the IP address is sent to the US.

Additionally, individuals can log in to the Commission’s website using their Facebook profiles. The Irish Data Protection Commissioner is now looking into a complaint alleging that the US-based social networking platform improperly transferred users’ personal data to the US.

The lawsuit sent two inquiries to the European Commission, which runs the website, seeking details on how personal data is handled. One of the requests received an incomplete response, and the other received no response at all, infringing the data protection law’s information rights, alleges the case.

The decision from the EU court is likely to take 12 to 18 months.