Record fine against Amazon: Administrative court confirms CNPD decision in the amount of 746 million euros

The Administrative Court of Luxembourg confirms a record fine against Amazon.
Categories:

The Luxembourg data protection supervisory authority Commission Nationale pour la Protection des Données (CNPD) imposed a record fine on Amazon Europe Core S.à r.l. on July 15, 2021 in the amount of 746 million euros was imposed. The Luxembourg Administrative Court confirmed this decision in full on March 18, 2025.

CNPD imposes record fine against Amazon

The starting point for the proceedings was the comprehensive analysis of the data-based advertising measures of Amazon Europe Core S.à r.l. by the Luxembourg data protection supervisory authority CNPD. As part of a long-term investigation, the processes for collecting, storing, analyzing and processing personal data by Amazon were reviewed. In particular, the focus was on the use of this data for interest-based AdvertisingThis is the personalized display of advertising content based on user behavior, previous purchases and other digital traces.

The CNPD found that Amazon does not have an effective Consent of the persons concerned for the Processing of their personal data for advertising purposes. Instead, Amazon relied on a legitimate interest pursuant to Article 6(1)(f) GDPRHowever, this was not considered sufficient in the specific case. The authority found that the interests, fundamental rights and freedoms of the users concerned outweighed Amazon's economic interests.

In addition, serious deficits were identified in the area of Transparency found. The data subjects were neither sufficiently nor comprehensibly informed about the purpose of the data processing. The structure of the privacy policy and the accessibility of relevant information were also inadequate in the opinion of the authority. This constituted a violation of Articles 12 to 14 GDPR represent.

Furthermore, Amazon was found to have serious deficiencies in the implementation of the Rights of data subjects accused. Requests for information pursuant to Article 15 GDPR had not been answered or had only been answered incompletely. The company had also violated the rights to Correction, Deletion and Contradiction were not adequately taken into account. The CNPD considered these to be systematic violations of Articles 16, 17 and 21 GDPR.

746,000 euros penalty payment per day for non-implementation

Due to these violations, the CNPD imposed a ban in July 2021. Fine in the amount of 746 million euros. In addition, specific remedial measures were imposed on Amazon. In the event of non-implementation, a daily penalty payment of 746,000 euros was threatened. In addition, the authority ordered the publication of the decision in order to achieve a deterrent effect and Transparency for the public.

Amazon then brought an action against the decision - with the aim of having the sanctions lifted or at least reduced. This action has now been dismissed in its entirety by the Administrative Court of Luxembourg in a ruling dated March 18, 2025.

Reading tip: Mega fine against Meta - almost 800 million euros Fine

Key statements of the judgment

In its decision, the Administrative Court of Luxembourg confirmed all of the CNPD's key findings. After an in-depth examination, the court concluded that Amazon Europe Core S.à r.l. had violated fundamental provisions of the General Data Protection Regulation. In particular, the focus was on the unlawful Processing of personal data for the purpose of personalized Advertising.

The court clarified that a Processing for advertising purposes can be permissible in principle - but only if it is based on a valid legal basis. This was not the case in the Amazon case. The invocation of a legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR In view of the intensity of the Processing and the lack of an effective Consent would not have been sustainable. The economic benefit for Amazon in no way justifies the profound profile building and the comprehensive Tracking users across multiple platforms.

The court placed particular emphasis on the transparency obligations. It confirmed the CNPD's view that the information provided by Amazon on data processing was inadequate, unclear and in some cases misleading. This not only constituted a formal deficiency, but also substantially impeded the exercise of the rights of the data subjects.

Also with regard to the implementation of the Rights of data subjects the court showed no leniency. Requests for information had been answered incompletely or late. Correction and deletion requests had been implemented only slowly or not at all, which indicated structural deficits in Amazon's data protection management. The same applies to the handling of objections to data processing.

Another key aspect was Amazon's lack of response to the measures ordered by the CNPD. The company had not made sufficient efforts over a long period of time to remedy the data protection violations. The court considered this persistent inaction to be a continued disregard of European data protection law, which further justified the level of the sanction.

Significance of the Amazon decision for practice

With this ruling, the Administrative Court of Luxembourg is sending a signal to large tech companies: Even global market leaders must submit to the requirements of transparent, fair and lawful data processing - especially when it comes to profiling for advertising purposes.

The ruling also highlights the importance of the Compliance with data subject rights. Companies that operate on a large scale personal data are well advised to process their Duty to informThe information processes and options for objection must be regularly reviewed and documented accordingly. Data protection through technology design (Privacy by design) and data protection-friendly default settings (Privacy by default) should be integrated right from the start.

For data protection officers, this ruling means that compliance with the GDPR is not only legally binding, but also highly relevant in economic terms. Regular audits, a documented rights management system and Technical and organizational measures (TOMs) are essential - especially for data-driven business models. A Risk-based approach in data protection management helps to identify and eliminate potential weaknesses at an early stage.

Outlook: Amazon can play for time

Amazon now has the opportunity to appeal against the ruling Appeal before the Cour administrative appeal. The appeal proceedings have been granted suspensive effect pending the decision of the next instance. It remains to be seen whether the company will take this route.

Source: Notice from the Administrative Court of Luxembourg

Tip: Don't risk any fines! With Ailance, you can automate the majority of your data protection and compliance tasks. Contact us and we will be happy to introduce you to our solutions.
☎️ +49 (228) 926165-100
📧info@2b-advice.com

Tags:
Share this post :