Amazon discloses record-shattering $887M GDPR fine

The fine, which has yet to be confirmed by the Luxembourg National Commission for Data Protection (CNPD), would completely shift the enforcement landscape of the EU’s landmark privacy law. The total is more than double the combined amount of the 741 penalties handed out under the GDPR to date, according to Privacy Affairs, and nearly 15 times larger than the €50 million penalty Google was hit with in France in 2019 that has stood as the record since.

The penalty would also be just the 11th to come out of Luxembourg, where the largest fine so far has been €18,000 against an unknown company in late May, according to the GDPR Enforcement Tracker.

An Amazon spokesperson said the e-commerce giant intends to appeal the fine.

“Maintaining the security of our customers’ information and their trust are top priorities,” the spokesperson said. “There has been no data breach, and no customer data has been exposed to any third party. These facts are undisputed. We strongly disagree with the CNPD’s ruling, and we intend to appeal. The decision relating to how we show customers relevant advertising relies on subjective and untested interpretations of European privacy law, and the proposed fine is entirely out of proportion with even that interpretation.”

In the filing, Amazon—whose European headquarters are based in Luxembourg—said it was notified of the fine by CNPD on July 16. The decision by the regulator further calls on Amazon to revise its data privacy practices.

The Wall Street Journal in June reported the Luxembourg data protection authority was preparing to fine Amazon more than $425 million over the way it collects personal data and uses it for marketing purposes. It is unclear what might have caused the fine to double. The Luxembourg DPA “does not comment on specific cases.”

The GDPR has the potential to fine companies up to 4 percent of their global revenues, which would be well into the billions for a firm like Amazon.