The Administrative Court of Luxembourg has cancelled a massive fine of €746 million that was issued against Amazon for several violations of Europe’s privacy laws.

The National Commission for Data Protection (CNPD), Luxembourg’s privacy and data protection authority (DPA), launched an investigation into Amazon in 2018 after receiving a complaint from the French privacy advocacy group La Quadrature du Net.

Allegedly, Amazon collected personal data from customers and partners, including browsing and purchase history, to deliver personalized advertisements. The online retailer reportedly did so without obtaining users’ consent.

In 2021, the CNPD imposed a fine of €746 million on Amazon for its online behavioral advertising practices, arguing that the processing of its users’ personal data violated the General Data Protection Regulation (GDPR).

Amazon, which claimed that the imposed fine was disproportionate, appealed against the CNPD’s decision.

After years of deliberating, the Administrative Court of Luxembourg has ruled in favor of Amazon.

In a nutshell, the court found that Luxembourg’s privacy and data protection authority committed procedural errors. For starters, the NCPD didn’t properly justify how it calculated Amazon’s multi-million-euro penalty.

In addition, the DPA didn’t explain whether Amazon acted intentionally or negligently. Lastly, the privacy regulator didn’t consider other penalties before issuing the huge fine. Therefore, the court ruled that the fine is legally flawed, meaning the entire case must be retried.

Amazon is happy with the new verdict. “We strongly disagreed with the initial ruling and disproportionate fine that had originally been ​issued in this case, which is why ​we appealed,” the company wrote in a statement after the Administrative Court overturned the NCPD’s decision.

In a press release, Luxembourg’s privacy regulator states that the Administrative Court has endorsed the CNPD’s approach almost in its entirety and confirmed that Amazon’s reliance on legitimate interests as the legal basis for the processing operations in question was not justified.

“Our action has led to Amazon’s practices being brought into full compliance with the relevant provisions of the case regarding online behavioral advertising,” the NCPD concluded.

---

Unlock more exclusive Cybernews content on YouTube.