数据安全 | 欧盟委员会被诉违反GDPR向美国传输公民个人数据

闪涛律师团队 LEGAL EYE 看法见法 2024-01-09

关键词：区块链；人工智能；大数据；智能合约；涉外法律服务；专业律师

本期关键词：欧盟委员会；数据保护条例；个人数据

本文约1619字，大概需要阅读3分钟。

2022年，7月19日欧盟委员会被一名德国公民起诉其在向美国传输其网站上公民个人数据时违反了欧盟数据保护规则。该诉讼涉及欧盟未来论坛（Conference of the Future of the Europe）的网站，该网站由“亚马逊网络服务”（Amazon Web Service）托管，且欧盟委员会允许用户通过Facebook账户登录网站，因此注册账户，IP地址等个人数据将被传输至美国。然而，在“Schreme II”案欧盟法院裁定美国辖区缺乏充分的数据保护后，欧盟与美国间尚未达成新的数据传输协议，因此欧盟委员会或涉嫌非法向美国传输欧盟公民个人数据。

// 新闻全文 //

This story was updated to clarify the data protection rules applying to the European Commission.

The European Commission is to face a lawsuit over allegations it is violating its own data protection rules when transferring citizens’ personal data from one of its websites to the United States.

International data transfers across the pond were ruled illegal by the EU Court of Justice two years ago in the landmark Schrems II ruling, thus defining the interpretation of the EU’s General Data Protection Regulation.

The American jurisdiction was deemed to have inadequate data protection, as US intelligence services could access the personal data of EU residents disproportionally and with no judicial remedy.

The GDPR does not directly apply to the EU institutions, which are bound by a similar regulation, but the lawsuit is expected to extend the effect of the Schrems II ruling to them as well.

The suit was initiated by a German citizen who not only states the EU executive is illegally transferring data but claims it fails to disclose sufficient information on its data processing practices.

“The lawsuit against the European Commission is a signal for data protection in Europe,” says Thomas Bindl, founder of Europäische Gesellschaft für Datenschutz, the organisation supporting the plaintiff in the case.

“Even if a ruling by the General Court would not provide any direct guidelines for the jurisprudence in Germany, Spain or other countries, we see great significance in it. It would be a clear sign that everyone must adhere to the data protection requirements,” he added.

The litigation regards the website of the Conference of the Future of Europe, a conference meant to engage EU citizens in deciding the future of the bloc and its member states.

Amazon Web Services host the website, hence when registering for the event, personal data such as the IP address is transferred to the United States.

Moreover, the Commission’s website also allows users to log in via their Facebook accounts. The US-based social media has also been challenged for illegally transferring personal data to the US, and a complaint in this regard is currently being looked into by the Irish Data Protection Commissioner.

As the European Commission is the website’s operator, the plaintiff asked for information on how personal data is processed in two inquiries. According to the lawsuit, one of the inquiries was answered incompletely, and the other was not answered at all, violating the information rights under the data protection law.

Bindl told EURACTIV that if a restaurant or a bakery has to figure out a way to comply with the ban on data transfers to the United States, so does the European Commission, as there cannot be double standards.

EuGD initiated the lawsuit in parallel with filing a complaint before the European Data Protection Supervisor, the authority that has jurisdiction over the application of the data protection rules by EU institutions. However, the EDPS has put investigations on hold because a lawsuit is pending.

The European Data Protection Supervisor and the European Commission did not immediately respond to a request for comment.

The EU court’s verdict is expected to take between 12 and 18 months.

[Edited by Alice Taylor]

中文翻译：

本文更新是以阐明适用于欧盟委员会的数据保护规则。

欧盟委员会将面临诉讼，指控其在将公民个人数据从其一个网站转移到美国时违反了自己的数据保护规则。

两年前，欧盟法院在具有里程碑意义的 Schrems II 裁决中裁定跨国数据传输是非法的，从而定义了欧盟通用数据保护条例的解释。

美国司法管辖区被认为没有足够的数据保护，因为美国情报机构可以不成比例地访问欧盟居民的个人数据，而且没有司法补救措施。

GDPR 并不直接适用于受类似法规约束的欧盟机构，但预计该诉讼会将 Schrems II 裁决的影响扩大到它们。

该诉讼是由一名德国公民发起的，他不仅声称欧盟执行官正在非法传输数据，而且声称它未能披露有关其数据处理的足够信息。

“针对欧盟委员会的诉讼是欧洲数据保护的一个信号，”支持本案原告的组织 Europäische Gesellschaft für Datenschutz 的创始人 Thomas Bindl 说。

“即使普通法院的裁决不会为德国、西班牙或其他国家的判例提供任何直接指导，我们也看到了它的重大意义。这将是一个明确的信号，表明每个人都必须遵守数据保护要求，”他补充道。