Brussels ‘flagrantly breached’ EU privacy law