Court overturns record fine for Amazon
Yunus Tuğ, Unsplash
The Luxembourg Administrative Court has ruled to annul a €746 million fine imposed on Amazon by the National Data Protection Commission (CNPD). The court proceedings concerned a sanction imposed in July 2021 in compliance with the General Data Protection Regulation (GDPR). Although the violations were confirmed during the hearings, the court found that the procedure for imposing the penalty was legally incorrect.
The judges' main complaint against the regulator (CNPD) was that it had failed to properly assess the degree of the company's guilt. According to the case file, the commission imposed a multi-million euro fine almost automatically, without establishing whether the violations were the result of direct intent or negligence. The court ruling emphasises that the established practice of the European Court of Justice (ECJ) explicitly requires supervisory authorities to conduct a detailed investigation of the psychological aspect of the offence before calculating the amount of the penalty.
As a result of this decision:
- The current ruling on the payment of €746 million has been declared invalid.
- The National Data Protection Commission (CNPD) is obliged to review the case in accordance with all procedural requirements.
- The court's decision creates an important barrier against the automatic imposition of heavy penalties without a thorough analysis of the data subject's behaviour.
Although the online retailer's GDPR violations were officially recorded, the lack of analysis of the parties' culpability made it impossible to uphold the record-breaking fine in the country's history. Now, the regulator will have to re-justify the proportionality of the punishment to the nature of the mistakes made.
