Luxembourg Court Overturns Amazon's $854M Privacy Fine

• The court found Luxembourg's CNPD did not examine whether Amazon intentionally violated GDPR rules or was merely negligent, and 'almost automatically' issued the fine without considering other sanction options
• The original 2021 penalty concerned Amazon's processing of users' personal data for online behavioral advertising, which regulators said breached EU privacy rules
• Despite the fine being annulled, the CNPD stated that Amazon has already brought its advertising practices into full compliance with relevant GDPR provisions

Summary: Luxembourg Court Overturns Amazon's $854M Privacy Fine

Key Development: A Luxembourg court has overturned a record €746 million ($854.4 million) fine against Amazon imposed by the country's National Commission for Data Protection (CNPD) in 2021, ordering a complete reassessment of the case.

Background: The CNPD originally penalized Amazon for violating the EU's General Data Protection Regulation (GDPR) through its online behavioral advertising practices and processing of users' personal data. A lower court had previously upheld the fine, prompting Amazon's subsequent appeal.

Court Ruling: Judges sided with Amazon's argument that the privacy watchdog failed to properly analyze whether the company intentionally violated GDPR or acted negligently. The court also found that CNPD did not examine alternative sanction options and imposed the fine "almost automatically." The regulator must now conduct a comprehensive analysis from scratch.

Company Response: Amazon welcomed the decision, stating it "strongly disagreed with the initial ruling and disproportionate fine." The CNPD acknowledged the ruling but noted that its action resulted in Amazon bringing its practices into "full compliance" with relevant GDPR provisions regarding online behavioral advertising.

Market Implications: This ruling represents a significant victory for Amazon and could set precedent for how EU privacy regulators must justify massive fines against tech companies. The decision may embolden other firms to challenge GDPR penalties and could impact the enforcement approach of data protection authorities across the EU. The case highlights ongoing tensions between tech giants and European regulators over privacy compliance and the appropriate level of penalties for violations.