Luxembourg: Administrative Court annulled National Data Protection Commission decision and referred Amazon case back for reassessment

On 12 March 2026, the Administrative Court issued a judgment annulling the National Data Protection Commission’s decision and sent the Amazon case back for reassessment. The ruling concerned an appeal against the Court’s previous judgment of 18 March 2025, which had upheld the CNPD decision of 15 July 2021. That decision had imposed a fine of EUR 746 million and coercive measures under penalty of a daily fine of EUR 746'000 on an online commerce operator for violations of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR), including non-compliance with the legal basis for data processing, failures in transparency obligations, and infringements of the rights of individuals to access, rectify, and erase their personal data, as well as the right to object to data processing. In judgment No. 52757C, the Court confirmed the essential GDPR violations identified at the time of the opening of the investigation but annulled the CNPD decision in all its aspects and referred the case back to the CNPD. The Court found that the CNPD had failed to analyse the existence of wrongful conduct on the part of the data controller and had failed to conduct a sufficiently thorough analysis of the selection of the most appropriate measure from those provided for under the applicable regulations. The Court dismissed procedural grounds raised by the appellant, with the exception of grievances based on Article 21 of the GDPR, which were found to fall outside the scope of the investigation. Costs and expenses of both proceedings were combined and imposed equally on each party.