Luxembourg court of appeal cancels EUR 746 million CNPD fine against Amazon
In a significant development for General Data Protection Regulation (“GDPR”) (Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data enforcement), the Luxembourg administrative court of appeal has cancelled the EUR 746 million fine imposed on Amazon by the Luxembourg Commission Nationale pour la Protection des Données (“CNPD”). This fine, originally issued in 2021, concerned Amazon’s processing of personal data for targeted advertising purposes, which the authority considered incompatible with GDPR requirements.
While the lower court had previously upheld the CNPD’s decision, the court of appeal took a different view and set aside the fine. The annulment is primarily based on shortcomings in the CNPD’s reasoning and assessment of the sanction. In particular, the court found that essential elements required under EU law were not sufficiently substantiated, including the analysis of the nature and seriousness of the infringement, as well as the degree of culpability.
The court also criticised the way in which the CNPD determined the amount of the fine, noting that the authority must clearly justify the proportionality of the sanction and take into account all relevant circumstances. This includes, where appropriate, considering alternative corrective measures before imposing a financial penalty of such magnitude.
Importantly, the judgment does not necessarily mean that no infringement occurred. Rather, it reflects the court’s expectation that supervisory authorities comply with strict procedural and reasoning standards when adopting enforcement decisions. The case has been referred back to the CNPD, which will need to reassess the matter in light of the court’s decision.
The CNPD has indicated that its intervention has already led to changes in Amazon’s practices, suggesting that the case has had a tangible compliance impact despite the annulment of the fine.
From a practical perspective, this decision highlights the increasing scrutiny applied by courts to GDPR sanctions. For companies, it underlines the importance not only of ensuring compliance with data protection rules, but also of maintaining clear documentation and governance frameworks capable of supporting their position in the event of regulatory investigations.
Do not hesitate to contact us for more information on this matter and visit our website and social media.
Photo – Rosc Art
