Official Journal of the European Union

C series

—

C/2025/2371

28.4.2025

Case C-211/25 P)

(C/2025/2371)

Language of the case: German

Parties to proceedings

Appellant: Thomas Bindl (represented by: T. Herbrich, C. Däuble and P. Hense, Rechtsanwälte)

Other party to the proceedings: European Commission

Form of order sought

The appellant claims that the Court should:

—annul in part the judgment of the General Court of 8 January 2025 in Case T-354/22;

—annul the transfers by the European Commission of the appellant’s personal data to recipients registered in third countries without an appropriate level of protection for the appellant which took place when logging in to the website https://futureu.europa.eu on 30 March 2022 and on 8 June 2022 as well as when registering for the ‘GoGreen’ event on 30 March 2022 which infringed Chapter V of Regulation (EU) 2018/1725. (1)

—find that the Commission unlawfully failed to act upon the appellant’s request of 1 April 2022 for information regarding the Commission’s processing of his personal data as well as regarding the appropriate safeguards under Article 48 of Regulation 2018/1725 in relation to the transfer to recipients registered in third countries;

—order the Commission to pay compensation, in addition to the amount awarded, in respect of the damage suffered in the amount of EUR 800.00, plus interest at the interest rate applied by the European Central Bank to its main refinancing operations, plus 2 percentage points, from the date of delivery of the judgment, which damage was caused to the appellant by the misapplication of Regulation 2018/1725;

—order the Commission to pay the costs of the proceedings.

Pleas in law and main arguments

The appellant relies on three grounds of appeal:

In the first place, the appellant submits that the General Court erred in taking the view that the first head of claim seeking annulment was inadmissible. In so doing, it failed to comply with the conditions of the fourth paragraph of Article 263 TFEU and failed to examine the case-law of the Court of Justice cited by the appellant.

Furthermore, the position of the General Court is also contrary to the appellant’s right, guaranteed by primary law, to effective judicial protection under Article 47 of the Charter of Fundamental Rights of the European Union (‘the Charter’).

Since, according to the settled case-law of the Court, any processing of personal data entails an interference with the protection of personal data guaranteed by Article 8 of the Charter, the transfer by the Commission of the appellant’s personal data to recipients established in third countries infringes his fundamental right under Article 8 of the Charter and thereby directly affects the appellant’s legal situation as a holder of fundamental rights. Consequently, contrary to what might be the case for factual internal administrative acts or purely informative communications, the transmission of data in question cannot be regarded as a physical act.

Second, the appellant complains that the General Court erred in taking the view, with regard to the request for a declaration that the Commission had failed to act, that the dispute in that regard had been dealt with via the Commission’s response of 30 June 2022. Furthermore, the General Court erred in taking the view that the Commission had complied with the appellant’s request for information by means of the reply in question. In that regard, the General Court did not examine the appellant’s relevant submission at all.

In the information provided on 3 December 2021, the Commission did not specify in full the entities, such as Amazon Web Services Inc and its subcontractors, which were recipients of the processing which constitutes the subject matter of the dispute. In addition, the Commission did not specify Meta Platforms, Inc. as a recipient, even though it used the Facebook Login function and it was not disputed that the appellant’s personal data had been transmitted to Meta Platforms, Inc. It is thereby clear that the Commission has failed to fulfil the appellant’s request for information by means of the response of 30 June 2022 or to date, almost four years after the request was made.

Where, in the event of a failure to act, EU citizens are able effectively to assert their right to information enshrined in primary law only by means of an action for damages pursuant to the law on State liability after the infringement has occurred, that is incompatible with the right to effective judicial protection under Article 47 of the Charter.

Third and last, the appellant submits that the General Court erred in concluding that there had been no sufficient demonstration that the Commission had infringed Article 17(1) and (2) of Regulation 2018/1725. The information at issue in the present case provided by the Commission on 3 December 2021 and 30 June 2022 in respect of the transfer of the appellant’s personal data to third country recipients was, as established by the Court, incomplete, inaccurate and late, and thereby incorrect, and represents an infringement of Article 17(1) and (2) of Regulation 2018/1725.

The General Court also erred in law in finding that the appellant had failed to put forward any other arguments relating to a breach of the principle of transparency and that, therefore, that complaint lacked any content independent of the assertion that the Commission failed to comply with the time-limit for replying to the request for information and failed to fulfil its obligation to state the reasons for that infringement. An infringement of the right of access provided for in Article 17 of Regulation 2018/1725 always additionally entails an infringement of the principle of transparency laid down in Article 4(1)(a) of Regulation 2018/1725.

The General Court also erred in law in finding that the Commission’s infringement of Article 14(3) of Regulation 2018/1725 caused no non-material damage to the appellant. There is non-material damage for which compensation can be awarded because the appellant is deprived of the effective exercise of his rights under Regulation 2018/1725. Furthermore, the loss of control suffered by the appellant constitutes damage for which compensation may be awarded.

—

Regulation 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision 1247/2002/EC (PE/31/2018/REV/1) (OJ 2018 L 295, p. 39).