In a classic case of “do as I say, not as I do” the European Parliament was found guilty of violating the GDPR.

For those that don’t know, GDPR stands for General Data Protection Legislation. GDPR governs the way in which we can use, process, and store personal data (information about an identifiable, living person). It applies to all organizations within the EU, as well as those supplying goods or services to the EU or monitoring EU citizens.

In the United States, we require all adult performers to not only be over 18 years of age but prove it. These regulations are commonly referred to at 2257. However the irony here is that to be compliant with US 2257 regulations, you are therefore are violating GDPR statutes.

But it looks like we aren’t the only ones.

The European Data Protection Supervisor (EDPS) issued a decision after a complaint filed by noyb confirming that the European Parliament violated data protection law on its COVID testing website. The EDPS highlights that the use of Google Analytics and the payment provider Stripe (both US companies) violated the Court of Justice’s (CJEU) “Schrems II” ruling on EU-US data transfers. The ruling is one of the first decisions implementing “Schrems II” on the ground and may show the way for hundreds of other cases pending before regulators.

In January 2021, noyb filed a complaint against the European Parliament on behalf of six Members of the European Parliament over an internal corona testing website. The issues raised were deceptive cookie banners, vague and unclear data protection notices, and the illegal transfer of data to the US. The EDPS investigated the matter and issued a reprimand on the Parliament for violation of the “GDPR for EU institutions” (Regulation (EU) 2018/1725 applicable only to EU institutions).

The long and short of it is, they are in violation of the very laws they are meant to enforce. Can anyone say OOOPS!

You can read the full story about it here.