Amazon faces record EU fine over GDPR 'breach'

Luxembourg's data protection authority accused the online retailer of processing personal data in violation of the rules

Amazon said it will appeal the decision to fine it over breaches of data protection rules. 

Amazon faces the biggest ever EU privacy fine after its lead privacy watchdog hit it with a €746m penalty for violating the union’s tough data protection rules.

CNPD, the Luxembourg data protection authority, slapped the online retailer Amazon with the record fine, accusing it of processing personal data in violation of the EU’s General Data Protection Regulation, or GDPR.

Amazon disclosed the findings in a regulatory filing, saying the decision is “without merit".  

“There has been no data breach, and no customer data has been exposed to any third party,” Amazon said, adding that it plans to appeal. 

These facts are undisputed. We strongly disagree with the CNPD’s ruling.

The decision concludes a probe started by a 2018 complaint from French privacy rights group La Quadrature du Net. It cautiously welcomed the decision.

“It’s a first step to see a fine that’s dissuasive, but we need to remain vigilant and see if the decision also includes an injunction to correct the infringing behaviour,” said Bastien Le Querrec, a member of La Quadrature’s litigation team, adding the group hadn’t received the decision.

EU data protection regulators’ powers have increased significantly since the bloc’s GDPR rules took effect in May 2018. 

It allows watchdogs for the first time to levy fines of as much as 4% of a company’s annual global sales. The biggest fine to date was a €50m penalty for Google issued by France’s CNIL.

• Bloomberg