Court Upholds Record GDPR Fine Against Amazon

The Administrative Court of Luxembourg has upheld a substantial fine imposed on Amazon, confirming a penalty of EUR746 million for violations of the General Data Protection Regulation (GDPR). This ruling follows an earlier decision made by the national data protection authority, the Commission nationale pour la protection des données (CNPD), which initially issued the fine in 2021.

At the core of the case were issues related to Amazon's advertising targeting practices. The CNPD concluded that the company failed to obtain necessary consent from users, thus breaching the GDPR requirements. In response to the fine, Amazon contested the CNPD's decision in October 2021, asserting there had been no infringement of personal data protection and that no customer data was disclosed to third parties. The company described the imposed fine as disproportionate.

A hearing was conducted at the Luxembourg Administrative Court in early 2024, and a recent ruling on March 18 confirmed the CNPD's original decision in its entirety. This means that Amazon is required to pay the fine and implement corrective measures mandated by the CNPD. Additionally, the court's judgment highlighted further breaches by Amazon, including violations of transparency, information obligations, and the rights of individuals regarding access to, correction, and deletion of processed data.

Amazon is now considering its legal options, including the possibility of appealing the decision, which could temporarily suspend the implementation of the fine. The company criticized the ruling, claiming that the CNPD's judgment was based on subjective interpretations of data protection laws, which lacked clear prior guidelines. The case may potentially escalate to the highest court in Luxembourg.

This ruling positions Amazon as the second-highest recipient of GDPR fines to date, following Meta Platforms, which was fined EUR1.2 billion in 2023 by the Irish Data Protection Commission (DPC) for processing data without legal grounds.

The court's decision reinforces the ongoing scrutiny that large tech companies face regarding their data handling practices and highlights the stringent enforcement of privacy regulations in the European Union.