Court Annuls €746 Million GDPR Fine Against Amazon
The High Administrative Court of Luxembourg annulled a €746 million fine imposed on Amazon by the Luxembourg Data Protection Authority (CNPD) for unlawful processing of personal data related to targeted advertising. The court confirmed that Amazon had violated several GDPR provisions, including the lack of a valid legal basis under Article 6(1)(f) GDPR for behavioral advertising and breaches of transparency and data subject rights. However, the court found procedural shortcomings in the CNPD’s sanction decision, specifically the failure to assess fault and proportionality before imposing the fine.
The case originated from a complaint filed in 2018 by the French organization La Quadrature du Net, which challenged Amazon’s reliance on legitimate interest as a legal basis for processing personal data for targeted advertising. The CNPD investigated and found multiple GDPR infringements, including failures to respect rights such as access, rectification, erasure, and objection. Amazon contested the CNPD’s decision, but both the Administrative Court and the High Administrative Court upheld the findings of GDPR violations while scrutinizing the sanction’s legality.
The High Administrative Court emphasized that the CNPD had not properly examined whether Amazon acted intentionally or negligently, a requirement established by recent Court of Justice of the European Union (CJEU) case law. Furthermore, the CNPD did not adequately consider alternative corrective measures or apply proportionality principles when deciding on the fine. As a result, the court annulled the fine and referred the case back to the CNPD to reassess fault and proportionality before any new sanction could be imposed.
Notably, the court confirmed that Amazon had updated its practices since the investigation, now relying on user consent under Article 6(1)(a) GDPR for targeted advertising, which the CNPD deemed compliant. Consequently, the original compliance orders and penalty payments were considered moot. The court also dismissed claims for procedural damages and divided legal costs equally, reinforcing the principle that sanctions must be fair, transparent, and based on a careful legal assessment.
