CNPD – Court Ruling (Luxembourg, 2026)

In 2018, the French non-profit organisation La Quadrature du Net filed a complaint against Amazon (the controller). The organisation claimed that Amazon could not rely on the legal basis of legitimate interest for processing personal data for targeted advertising. It also claimed that Amazon failed to respect several rights of the data subjects. On 15 April 2019, the Luxembourg Data Protection Authority (CNPD) opened an investigation as the lead DPA under the cooperation mechanism. The CNPD examined whether Amazon had a valid legal basis under Article 6 GDPR and whether it complied with transparency obligations and data subject rights under Articles 12 to 17 GDPR and Article 21 GDPR. On 15 July 2021, the CNPD adopted a decision finding multiple infringements of the GDPR. It held that Amazon did not have a valid legal basis for behavioural advertising under Article 6(1) GDPR at the time of the investigation. The CNPD also found breaches of transparency obligations and failures to respect the rights of data subjects, including the right of access, the right to erasure, and the right to object. The CNPD imposed an administrative fine of €746,000,000. It also ordered Amazon to bring its processing operations into compliance within six months and imposed a periodic penalty payment in case of non-compliance. Amazon challenged the decision before the Administrative Court (Luxembourg), arguing that the CNPD violated procedural rules, including the right to a fair procedure, the right of defence, and the principle of impartiality. Amazon also argued that the CNPD exceeded the scope of its investigation and denied access to parts of the file. On the merits, Amazon claimed that it could rely on Article 6(1)(f) GDPR (legitimate interests) and that it had complied with transparency and data subject rights obligations. The Administrative Court rejected Amazon’s action and upheld the CNPD’s decision. Amazon appealed to the higher Administrative Court. In its judgment of 12 March 2026, the High Administrative Court ruled on the appeal against the judgment of the Administrative Court of 18 March 2025, which had dismissed Amazon’s appeal against the CNPD decision of 15 July 2021. The Court first confirmed that, at the time of the investigation in 2019, Amazon’s processing of personal data for targeted advertising could not rely on Article 6(1)(f) GDPR as a legal basis. The Court also upheld the CNPD’s findings that Amazon had breached transparency obligations and failed to respect data subjects’ rights, including the right of access, the right to rectification, and the right to object. The Court considered the facts at the time the investigation was opened as the relevant reference for assessing these infringements. However, the Court identified two major shortcomings in the CNPD’s decision regarding the sanction. First, it noted that the CNPD had not assessed whether the infringements were committed intentionally or through negligence. The Court relied on recent case law of the Court of Justice of the European Union (CJEU), namely the Deutsche Wohnen and Nacionalinis judgments of 5 December 2023 (C-807/21 and C-683/21), which established that supervisory authorities must verify fault before imposing administrative fines under the GDPR. This analysis was necessary at the time the CNPD adopted its decision. Second, the Court found that the CNPD had not properly exercised discretion in determining the penalty. It observed that the authority had treated a fine as an automatic consequence of finding violations, without considering the full range of corrective measures and selecting the most appropriate one according to the principles of proportionality and effectiveness under the GDPR. Because of these shortcomings, the Court annulled the CNPD’s decision in all its aspects. It referred the case back to the CNPD so that the authority could carry out, for the first time, the fault assessment and the proportionality assessment of any potential fine. The Court emphasised that it could not itself impose a sanction without violating the principle of an effective remedy guaranteed under the GDPR. The Court confirmed that its annulment did not affect the underlying substantive findings. The breaches identified by the CNPD in 2019 remain valid. However, the Court noted that Amazon had since modified its processing operations and now relies on user consent under Article 6(1)(a) GDPR as the legal basis for targeted advertising. The CNPD confirmed that these new practices comply with the GDPR, making the original compliance orders and periodic penalties moot. The Court dismissed both parties’ claims for procedural damages and divided the costs of both proceedings equally.