The European Union scrutinized itself and identified…genuine misconduct! For the first occasion, the EU has been found to have breached its own privacy regulations established by the General Data Protection Regulation (GDPR) and will need to pay a penalty, as determined by a ruling from the EU General Court.

The individual affected by the EU’s audacious violation of the law was a German resident who utilized the “Sign in with Facebook” feature when signing up for an event via a European Commission website. When the individual clicked that option, details about their device, browser, and IP address were transmitted through a content delivery network governed by Amazon Web Services and ultimately reached servers operated by Facebook’s parent entity Meta Platforms in the United States. The court concluded this data transfer occurred without adequate safeguards, resulting in a GDPR rules breach, and the EU was ordered to remit a penalty of €400 (approximately $412) directly to the claimant.

GDPR, the reason that every website now prompts you about accepting cookies, has been a persistent issue for tech firms since its inception in 2018. This set of rigorous data privacy regulations aimed at limiting the amount of personal data companies can gather from users and granting individuals greater control over how their data is accessed and utilized has led to several substantial fines paid by Big Tech companies—especially Meta.

Just in the past year, Meta was whacked with a $1.3 billion penalty for inadequate protection of European users’ information from US intelligence services when transferring the data to American servers. Before that, Meta faced a $417 million fine under GDPR guidelines for compromising the privacy of underage Instagram users and a $232 million penalty for failing to transparently explain how it processes WhatsApp data. While Meta isn’t the only company facing these hefty penalties (Amazon incurred an $887 million penalty in 2021, for example), it’s somewhat ironic that a Facebook login feature landed the EU in hot water with itself.

GDPR has had mixed outcomes since it was introduced. It certainly made headlines with substantial fines directed at the giants of Silicon Valley. However, enforcement is often prolonged—even the EU’s inaugural self-imposed fine for contravening an individual’s privacy took over two years to finalize. Over seventy-five percent of data protection authorities have cited a shortage of funding and staff to pursue infractions, and there is abundant evidence to suggest that these complex regulations have not significantly restrained the intrusive activities of surveillance capitalism. The EU has some challenges to address. Maybe it can begin by adhering to its own rules.