Luxembourg: Administrative Court issues ruling confirming National Data Protection Commission EUR 746 million fine against Amazon's breach of GDPR rules by using personal data without consent

On 18 March 2025, the Administrative Court of Luxembourg confirmed the decision of the National Data Protection Commission (CNPD) to impose a fine of EUR 746'000'000 against Amazon Europe Core, along with corrective measures under a daily penalty of EUR 746'000. The court rejected Amazon's appeal against the CNPD's decision of July 15, 2021, which found that the company had violated several articles of the General Data Protection Regulation (GDPR) related to the processing of personal data for interest-based advertising. The violations included non-compliance with the legal basis for data processing, failures in transparency obligations, and infringements on the rights of individuals to access, rectify, and erase their personal data, as well as the right to object to data processing. The court upheld the CNPD's analysis and ordered Amazon to implement the necessary corrective measures to comply with the GDPR. The court also maintained the suspensive effect of the appeal, allowing Amazon to appeal the judgment further.