Amazon GDPR Fine: EU Imposes Record $887M Penalty
Amazon Faces Record GDPR Fine from Luxembourg’s CNPD
A substantial €746 million ($887 million) penalty has been levied against Amazon by Luxembourg’s National Commission for Data Protection (CNPD). This fine stems from concerns regarding Amazon’s processing of customer data in relation to personalized advertising.
Amazon Disputes the Ruling
The company revealed the CNPD’s decision through a filing with the Securities and Exchange Commission (SEC) on Friday. Amazon strongly refuted the ruling, characterizing it as lacking a valid basis and declaring its intention to mount a robust defense against the charges.
An Amazon spokesperson emphasized the company’s commitment to data security and customer trust. They stated that no data breach has occurred, and no customer information has been shared with external parties – a point the company asserts is not contested.
“We fundamentally disagree with the CNPD’s assessment,” the spokesperson continued. “The decision concerning the presentation of relevant advertising to customers is founded upon interpretations of European privacy legislation that are both subjective and lack established precedent. Furthermore, the proposed fine is disproportionate, even considering this interpretation.”
Origin of the Complaint
This significant penalty arises from a complaint initially lodged in 2018 by the French privacy advocacy organization, La Quadrature du Net. This group represents the interests of numerous European citizens, advocating for the protection of their data against exploitation by large technology companies for manipulative purposes.
The original complaint, filed on behalf of over 10,000 individuals, also targeted other tech giants including Apple, Facebook, Google, and LinkedIn. It alleges that Amazon influences customer choices by controlling the advertising and information they are presented with, ultimately serving commercial interests.
Reaction from La Quadrature du Net
La Quadrature du Net expressed approval of the CNPD’s decision, noting that it followed a three-year period of inactivity that raised concerns about a potential lack of action.
The group articulated its belief that economic models reliant on the exploitation of privacy and individual autonomy are fundamentally unjust and incompatible with the principles of democratic societies.
Required Changes to Business Practices
The CNPD has mandated that Amazon implement changes to its operational procedures. However, the regulator has not yet released the full details of its decision publicly. Amazon has also not specified the precise revisions to its business practices that it intends to propose.
The case highlights the increasing scrutiny faced by technology companies regarding their data handling practices under the General Data Protection Regulation (GDPR).
