Digital Rights Groups Hail Record EUR746 Million Amazon Data Privacy Fine

Digital rights advocates on Friday applauded a EUR746 million fine levied against Amazon by a Luxembourg regulator for the tech giant's violation of European Union data privacy laws.

The record penalty--which converts to about U.S. $886 million--was imposed on July 16 by CNPD, Luxembourg's data protection agency, and disclosed in an Amazon regulatory filing (pdf) on Friday, according toBloomberg.

CNPD said Amazon violated the E.U.'s General Data Protection Regulation (GDPR), which requires companies to seek users' consent prior to using their personal data.

The fine--while small for a company whose revenue topped $386 billion last year--shatters the previous GDPR violation record of EUR50 million ($59.2 million) imposed by France's CNIL against Google in 2019. Responding to criticism about the relatively modest fines levied against companies like Amazon, CNPD Commissioner Marc Lemmer toldPolitico earlier this year that "the aim is not to have big sanctions--the aim is to have a change in culture."

The French digital rights group La Quadrature du Net ("Squaring the Net")--which filed a 2018 complaint against Amazon that led to the fine--and other advocacy organizations welcomed the CNPD sanction.

"It's a first step to see a fine that's dissuasive, but we need to remain vigilant and see if the decision also includes an injunction to correct the infringing behavior," La Quadrature du Net attorney Bastien Le Querrec told Bloomberg.

La Quadrature du Net said that "this 'party is over' sanction puts in even starker contrast the blatant abdication of the Irish Data Protection Agency who, in three years, was not able to close a single one of the four other actions we lodged against Facebook, Apple, Microsoft, and Google."

The group added that the fine "is also a cold shower for the French CNIL," which it called "but a shadow of its former self."

"Our collective actions were initially lodged before [CNIL], and would have given it a perfect opportunity to take the reins of enforcing the GDPR against the systemic violations of personal data and privacy, which lie at the heart of the business model of the web giants," La Quadrature du Net added.

Amazon--whose European headquarters are located in Luxembourg--responded to the fine by saying it believes the CNPD decision is "without merit" and that it would defend itself "vigorously in this matter."

"Maintaining the security of our customers' information and their trust are top priorities," an Amazon spokesperson said in a statement. "There has been no data breach, and no customer data has been exposed to any third party. These facts are undisputed."

Amazon--which is facing growing calls to be broken up in the United States--is also being investigated by E.U. antitrust authorities for allegedly unfairly favoring its own private-label brands, as well as over its voice assistants and data collection.