A Luxembourg court has annulled a €746 million fine imposed on Amazon, a US-based technology company, over alleged violations of European data protection rules, after finding errors in how the penalty was calculated and justified.
The fine was originally issued in 2021 by Luxembourg’s National Commission for Data Protection, the country’s data protection authority, following an investigation into Amazon’s online behavioural advertising practices. The regulator concluded at the time that Amazon processed user data for targeted advertising without valid consent, in breach of the General Data Protection Regulation.
Amazon appealed the decision, arguing that the penalty was disproportionate. The Administrative Court of Luxembourg ruled in favour of the company, stating that the regulator had failed to properly explain how it calculated the €746 million fine and did not assess whether the company’s actions were intentional or negligent.
The court also found that the authority did not sufficiently consider alternative corrective measures before imposing the financial penalty. As a result, it determined that the decision was legally flawed and referred the case back to the regulator for reassessment.
The ruling does not dismiss the underlying findings related to Amazon’s data processing practices. The regulator said in a statement that the court supported much of its original analysis and confirmed that Amazon’s reliance on “legitimate interests” as a legal basis for processing user data was not justified.
The investigation into Amazon began in 2018 following a complaint from the French advocacy group La Quadrature du Net regarding the company’s advertising practices. The €746 million penalty remains one of the largest fines issued under the GDPR framework.
Amazon said it welcomed the court’s decision, stating that it disagreed with the original ruling and the scale of the fine. The Luxembourg regulator said it would continue handling the case in line with the court’s findings.