On July 15th, 2021, Luxembourg’s data protection authority CNPD issued a decision regarding Amazon Europe Core S.à r.l because of infringements of the General Data Protection Regulation (GDPR).
Amazon launched an appeal against this decision on October 29, 2021. A hearing took place on January 9, 2024 before the Luxembourg Administrative Tribunal (“Tribunal administratif”), which rules on the merits of the case.
On March 18, 2025, the Luxembourg Administrative Tribunal decided to reject Amazon’s appeal and upheld the CNPD's original decision. This means that the fine imposed for GDPR infringements will stand, and Amazon will need to comply with the corrective measures ordered by the CNPD.
However, the effects of the CNPD's decision remain suspended during the appeal period and, if applicable, during any potential appeal procedure before the Administrative Court.
Whereas the decision of the Tribunal is public, the national law on data protection binds the CNPD to professional secrecy (Article 42) and prevents it from commenting on individual cases.