Administrative court confirms high fine against Amazon for violations of the GDPR

In its ruling of March 18, 2025, the Administrative Court upheld the decision of the National Commission for Data Protection (CNPD), which imposed a fine of €746 million on Amazon Europe Core SARL. The penalty was imposed for serious violations of the General Data Protection Regulation (GDPR). The court found that Amazon violated several articles of the regulation when processing personal data for advertising purposes, resulting in financial and regulatory consequences.

Verdict

By judgment of March 18, 2025, the Administrative Court dismissed Amazon Europe Core SARL's appeal against the decision of the National Commission for Data Protection (CNPD) of July 15, 2021. This decision imposed an administrative fine of EUR 746,000,000, ordered remedial measures subject to a penalty of EUR 746,000 per day, and ordered the publication of this decision.

The Court confirmed the CNPD's analysis that Amazon Europe Core SARL had infringed Articles 6, 12 to 17 and 21 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR) when processing personal data for interest-based advertising purposes.

The violations alleged against Amazon Europe Core SARL concern non-compliance with the legal basis for the processing of personal data, non-compliance with the transparency and information obligations towards the persons affected by the processing of their personal data, violation of the right of access to the data processed, violation of the right to rectification and erasure of the personal data processed and violation of the right to object to the processing of personal data.

The Court also found that Amazon Europe Core SARL had failed to take the necessary corrective measures to comply with Articles 6, 12 to 17 and 21 of the GDPR.

The court finally ordered the suspensive effect of the appeal during the time limit and the appeal proceedings.

An appeal against the Administrative Court’s judgment of 18 March 2025 may be lodged with the Administrative Court of Appeal.

Translated from French: https://justice.public.lu/fr/actualites/2025/03/tribunal-administratif-jugement-amazon-amende-cnpd.html

Conclusion

The Administrative Court's ruling underscores the importance of strict compliance with GDPR requirements, particularly with regard to transparency, information obligations, and the rights of data subjects. The decision makes it clear that companies like Amazon face significant consequences if they violate data protection regulations. The imposed fine and the remedial measures ordered send a clear signal about the importance of data protection at the European level.