CA Luxembourg - 52757C

Summary

The Luxembourg High Administrative Court annulled a €746 million fine imposed by the CNPD (Luxembourg Data Protection Authority) against Amazon for unlawful personal data processing for targeted advertising. While confirming that Amazon violated GDPR Articles 6, 12-17, and 21, the court found procedural shortcomings: the CNPD failed to assess whether infringements were intentional or negligent, and did not properly apply proportionality principles when determining the penalty. The case has been remitted to the CNPD for reassessment of fault and proportionality before imposing any new sanction.

Full text

Help CA Luxembourg - 52757C: Difference between revisions From GDPRhub Jump to:navigation, search ← Older editVisualWikitext Revision as of 09:56, 18 March 2026 view sourceRp (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators195 edits Tag: Visual edit← Older edit Latest revision as of 09:04, 16 April 2026 view source Sfl (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators405 editsm Line 67: Line 67: |Party_Link_4=|Party_Link_4= |Appeal_From_Body=Tribunal Administratif|Appeal_From_Body=Tribunal Administratif (Luxembourg) |Appeal_From_Case_Number_Name=46578|Appeal_From_Case_Number_Name=46578 |Appeal_From_Status=|Appeal_From_Status= Latest revision as of 09:04, 16 April 2026 CA Luxembourg - 52757C Court: CA Luxembourg (Luxembourg) Jurisdiction: Luxembourg Relevant Law: Article 6(1) GDPR Article 11 GDPR Article 12 GDPR Article 13 GDPR Article 14 GDPR Article 15 GDPR Article 16 GDPR Article 17 GDPR Article 21 GDPR Decided: 12.03.2026 Published: Parties: CNPD an Amazon subsidiary (AA) National Case Number/Name: 52757C European Case Law Identifier: ECLI:LU:CADM:2026:52757 Appeal from: Tribunal Administratif (Luxembourg)46578 Appeal to: Not appealed Original Language(s): French Original Source: Cour Administrative (in French) Initial Contributor: RP The High Administrative Court annulled a €746,000,000 fine against Amazon, confirming that Amazon unlawfully processed personal data for targeted advertising but requiring the DPA to reassess fault and proportionality before any new sanction. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts In 2018, the French non-profit organisation La Quadrature du Net filed a complaint against Amazon (the controller). The organisation claimed that Amazon could not rely on the legal basis of legitimate interest for processing personal data for targeted advertising. It also claimed that Amazon failed to respect several rights of the data subjects. On 15 April 2019, the Luxembourg Data Protection Authority (CNPD) opened an investigation as the lead DPA under the cooperation mechanism. The CNPD examined whether Amazon had a valid legal basis under Article 6 GDPR and whether it complied with transparency obligations and data subject rights under Articles 12 to 17 GDPR and Article 21 GDPR. On 15 July 2021, the CNPD adopted a decision finding multiple infringements of the GDPR. It held that Amazon did not have a valid legal basis for behavioural advertising under Article 6(1) GDPR at the time of the investigation. The CNPD also found breaches of transparency obligations and failures to respect the rights of data subjects, including the right of access, the right to erasure, and the right to object. The CNPD imposed an administrative fine of €746,000,000. It also ordered Amazon to bring its processing operations into compliance within six months and imposed a periodic penalty payment in case of non-compliance. Amazon challenged the decision before the Administrative Court (Luxembourg), arguing that the CNPD violated procedural rules, including the right to a fair procedure, the right of defence, and the principle of impartiality. Amazon also argued that the CNPD exceeded the scope of its investigation and denied access to parts of the file. On the merits, Amazon claimed that it could rely on Article 6(1)(f) GDPR (legitimate interests) and that it had complied with transparency and data subject rights obligations. The Administrative Court rejected Amazon’s action and upheld the CNPD’s decision. Amazon appealed to the higher Administrative Court. Holding In its judgment of 12 March 2026, the High Administrative Court ruled on the appeal against the judgment of the Administrative Court of 18 March 2025, which had dismissed Amazon’s appeal against the CNPD decision of 15 July 2021. The Court first confirmed that, at the time of the investigation in 2019, Amazon’s processing of personal data for targeted advertising could not rely on Article 6(1)(f) GDPR as a legal basis. The Court also upheld the CNPD’s findings that Amazon had breached transparency obligations and failed to respect data subjects’ rights, including the right of access, the right to rectification, and the right to object. The Court considered the facts at the time the investigation was opened as the relevant reference for assessing these infringements. However, the Court identified two major shortcomings in the CNPD’s decision regarding the sanction. First, it noted that the CNPD had not assessed whether the infringements were committed intentionally or through negligence. The Court relied on recent case law of the Court of Justice of the European Union (CJEU), namely the Deutsche Wohnen and Nacionalinis judgments of 5 December 2023 (C-807/21 and C-683/21), which established that supervisory authorities must verify fault before imposing administrative fines under the GDPR. This analysis was necessary at the time the CNPD adopted its decision. Second, the Court found that the CNPD had not properly exercised discretion in determining the penalty. It observed that the authority had treated a fine as an automatic consequence of finding violations, without considering the full range of corrective measures and selecting the most appropriate one according to the principles of proportionality and effectiveness under the GDPR. Because of these shortcomings, the Court annulled the CNPD’s decision in all its aspects. It referred the case back to the CNPD so that the authority could carry out, for the first time, the fault assessment and the proportionality assessment of any potential fine. The Court emphasised that it could not itself impose a sanction without violating the principle of an effective remedy guaranteed under the GDPR. The Court confirmed that its annulment did not affect the underlying substantive findings. The breaches identified by the CNPD in 2019 remain valid. However, the Court noted that Amazon had since modified its processing operations and now relies on user consent under Article 6(1)(a) GDPR as the legal basis for targeted advertising. The CNPD confirmed that these new practices comply with the GDPR, making the original compliance orders and periodic penalties moot. The Court dismissed both parties’ claims for procedural damages and divided the costs of both proceedings equally. Comment Share your comments here! Further Resources Share blogs or news articles here! English Machine Translation of the Decision The decision below is a machine translation of the French original. Please refer to the French original for more details. GRAND DUCHY OF LUXEMBOURG ADMINISTRATIVE COURT Case No.: 52757C ECLI:LU:CADM:2026:52757 Filed on April 25, 2025 Public Hearing of March 12, 2026 Appeal filed by the limited liability company (AA), …, against a judgment of the Administrative Court of March 18, 2025 (No. 46578 on the docket) ruling on its appeal against a decision of July 15, 2021, of the restricted panel of the National Commission for Data Protection (CNPD), concerning data protection Having regard to the appeal filed under No. 52757C on the docket and lodged with the Registry of the Administrative Court on April 25, 2025, by the limited partnership ALLEN OVERY SHEARMAN STERLING SCS, registered on List V of the The Luxembourg Bar Association, established and having its registered office at L-1855 Luxembourg, 5, avenue J.F. Kennedy, registered with the Luxembourg Trade and Companies Register under number B178291, represented for the purposes hereof by Thomas Berger, Attorney at Law, registered with the Luxembourg Bar Association, on behalf of the limited liability company (AA), established and having its registered office at L-..., registered with the Luxembourg Trade and Companies Register under number ..., represented by its current management board, against a judgment of the Administrative

Entities