Given the fact that on July 29, 2021 Amazon published its quarterly results and publicly disclosed that the company was imposed a fine from the Luxembourg regulator on data protection because of infringements with the General Data Protection Regulation (GDPR), the CNPD can hereby confirm that its restricted panel issued a decision on July 15th, 2021 regarding Amazon Europe Core S.à r.l within the European cooperation and consistency mechanism as foreseen by article 60 of the GDPR.
However, the national law on data protection binds the CNPD to professional secrecy (Article 42) and prevents it from commenting on individual cases.
In addition, the full and clear publication of the decisions of the CNPD is considered as a supplementary sanction (Article 52). Therefore, it cannot publish any decision before the deadlines for appeals have expired.
An appeal against the decisions of the CNPD can be made before the Administrative Tribunal, which rules on the merits of the case. The time limit for lodging an appeal is three months.
(...)
Section IX - Professional secrecy
Art. 42. Without prejudice to Article 23 of the Luxembourg Criminal Procedure Code, all persons exercising or having exercised an activity for the CNPD are bound by the obligation of professional secrecy and liable to the penalties set forth in Article 458 of the Luxembourg Criminal Code if the secrecy is violated. This secrecy requires that the confidential information received in the course of their professional activities cannot be disclosed to any person or authority, save in a summarised or aggregated form which does not permit the persons subject to supervision to be identified, without prejudice to cases under criminal law in the case of breach of secrecy.
(...)
Section XI –Sanctions
Art. 52. The CNPD may order, at the expense of the person sanctioned, the complete or partial publication of its decisions, excluding decisions relating to the imposition of periodic penalty payments, on the condition that:
1° all means of appeal against the decision have been exhausted and
2 ° the publication does not risk causing disproportionate damage to the parties concerned.
(...)