Court in Luxembourg confirms Amazon's record fine: 746 million euros for GDPR violation

A record fine imposed on Amazon for failing to comply with European legislation on the protection of personal data has come into force. On Wednesday, the Luxembourg Administrative Court confirmed the decision of the National Data Protection Commission (CNPD) of 15 July 2021, rejecting Amazon Europe Core SARL's complaint. The US e-commerce giant is now obliged to pay €746 million as well as implement corrective measures, failing which a daily penalty of €746,000.

The Court recognised that Amazon had breached several key provisions of the EU General Data Protection Regulation (GDPR). In particular, it concerns the unjustified legal basis for processing personal data, as well as the violation of the principles of transparency and informing users. In addition, the company restricted users' rights to access, rectify and oppose their data, which is a direct violation of European law.

Amazon, which had previously labelled the CNPD's decision as "unjustified", now finds itself in a position where the dispute has been definitively lost and the fine is a mandatory fine. The court also said that the company had failed to take the necessary steps to bring its data processing policy into compliance with GDPR regulations.

The verdict is a European precedent and the harshest blow yet to a multinational corporation in the area of digital regulation. It confirms the growing determination of European authorities to rigorously enforce personal data protection rules even against the world's largest companies.