They can't even follow their own rules:
https://techcrunch.com/2025/01/08/eu-court-fines-european-commission-for-breaching-its-own-data-privacy-laws/ [techcrunch.com]
A top court has ordered the European Union’s top executive authority to pay €400 (around $410) in damages to a German citizen for breaching its own data protection laws.
In a statement, the EU General Court said the European Commission violated the citizen’s rights by transferring some of his personal data to the United States without proper safeguards.