GDPR fine for Amazon: 746 million euros

As a result of a class action lawsuit filed by more than 10,000 individuals and the French civil rights organization "La Quadrature du Net," which targeted not only Amazon but also Google, Apple, Microsoft and Facebook, the Luxembourg National Commission for Data Protection (CNPD) has now imposed a GDPR fine of €746 million on Amazon on July 16, 2021.

However, the information on this that has been made public so far is based only on Amazon's quarterly report and a brief entry on ongoing legal disputes by the CNPD. The CNPD has not yet published anything about the decision, especially since, unlike other supervisory authorities, it is obligated to maintain secrecy in individual cases.

Allegations

Amazon was accused of processing personal data of Amazon customers in violation of the GDPR. The plaintiffs claim that Amazon's advertising system disregards the principle of necessary consent.

The CNPD also identified this violation and sanctioned it with the corresponding fine. The sum is the highest that has ever become public in the context of a GDPR sanction.

Reaction from Amazon

Amazon considers the CNPD's decision to be unfounded. According to its own statements, the company intends to "vigorously defend itself in this matter". The company claims that there has been no data breach and that no customer data has been passed on to third parties at any time.

Reaction of the plaintiffs

The organization sees the decision as a first step, but nevertheless it says it must "remain vigilant" about what happens next.

In response to Amazon's assertion that no data breach or disclosure occurred, the organization counters that this is precisely correct because it is not merely an occasional breach, but a data breach by the targeted advertising system itself.

The enormous fine, he said, should be celebrated as a hit "straight to the heart of BigTech's predatory system."