Euro watchdog will try to extract $900m from Amazon for breaking data privacy laws
(2021/07/31)
- Reference: 1627684392
- News link: https://www.theregister.co.uk/2021/07/30/amazon_european_privacy_fine/
- Source link:
Amazon says a European Union privacy watchdog has mustered the temerity to demand a $885m fine for failing to comply with data privacy rules.
"On July 16, 2021, the Luxembourg National Commission for Data Protection (CNPD) issued a decision against Amazon Europe Core S.à r.l. claiming that Amazon’s processing of personal data did not comply with the EU General Data Protection Regulation," the web goliath said in a financial filing accompanying its Q2 2021 earnings report
"The decision imposes a fine of €746m [$885m] and corresponding practice revisions."
[2]
Amazon said the CNPD decision has no merit and that it plans to challenge the ruling.
[3]
[4]
“Maintaining the security of our customers’ information and their trust are top priorities," Amazon said in a statement emailed to The Register . "There has been no data breach, and no customer data has been exposed to any third party. These facts are undisputed. We strongly disagree with the CNPD’s ruling, and we intend to appeal."
"The decision relating to how we show customers relevant advertising relies on subjective and untested interpretations of European privacy law, and the proposed fine is entirely out of proportion with even that interpretation."
[5]
The €746m fine is the largest penalty under the 2018 GDPR to date, surpassing the previous top penalty of €50m assessed by the French National Commission on Informatics and Liberty (CNIL) against Google in 2019 by almost 15x. In fact, Amazon's fine is more than twice the sum of all previous GDPR penalties combined ( [6]€303m ).
[7]Ex-Brave staffer launches GDPR sueball in Germany over tech giants' real-time bidding for ad inventory
[8]Truth and consequences for enterprise AI as EU know who goes legal: GDPR of everything from chatbots to machine learning
[9]Irish privacy watchdog sticks GDPR probe into Facebook after that online giveaway of 533 million profiles
[10]Can we exhale yet? EU set to rule UK 'adequate' for data sharing in post-Brexit GDPR move
The ruling follows from the CNPD's investigation of a May 28, 2018 complaint
The privacy group assailed Amazon's public statement about the absence of a data breach as a non sequitur, stating that the CNPD decision is a consequence of invasive ads rather than a database intrusion.
This historic fine hits straight to the heart of Big Tech’s predatory system, and should be celebrated as such
"It is the system of targeted advertising itself, and not merely occasional security breaches, that our legal action attacked," the group said in [13]a statement on its website. "This historic fine hits straight to the heart of Big Tech’s predatory system, and should be celebrated as such."
The privacy group also took the opportunity to contrast the massive CNPD fine with the failure of both the Irish Data Protection Authority and the CNIL to translate the group's complaints against Facebook, Apple, Microsoft and Google into meaningful penalties. And it celebrated the CNPD decision for restoring its faith in regulatory intervention.
"Business models based on domination and exploitation of our privacy and our free consent are disturbingly illegitimate and go against the values that our democratic societies claim to defend," the group said.
Elsewhere in its 10-Q filing, Amazon [14]reported $113.1bn in sales and an operating profit of $7.7bn for the quarter. ®
Get our [15]Tech Resources
[1] https://d18rn0p25nwr6d.cloudfront.net/CIK-0001018724/cbae1abf-eddb-4451-9186-6753b02cc4eb.pdf
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YQTK@vr5uDxoUdGZJPbZTQAAAE0&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YQTK@vr5uDxoUdGZJPbZTQAAAE0&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YQTK@vr5uDxoUdGZJPbZTQAAAE0&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YQTK@vr5uDxoUdGZJPbZTQAAAE0&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://dataprivacymanager.net/5-biggest-gdpr-fines-so-far-2020/
[7] https://www.theregister.com/2021/06/17/johnny_ryan_lawsuit_adtech/
[8] https://www.theregister.com/2021/04/19/ai_regulation_column/
[9] https://www.theregister.com/2021/04/15/irelands_top_data_privacy_watchdog/
[10] https://www.theregister.com/2021/02/15/uk_gdpr_adequacy/
[11] https://gafam.laquadrature.net/wp-content/uploads/sites/9/2018/05/amazon.pdf
[12] https://www.laquadrature.net/
[13] https://www.laquadrature.net/en/2021/07/30/amazon-fined-746-million-euros-following-our-collective-legal-action/
[14] https://www.theregister.com/2021/07/30/amazon_q2_2021/
[15] https://whitepapers.theregister.com/
"On July 16, 2021, the Luxembourg National Commission for Data Protection (CNPD) issued a decision against Amazon Europe Core S.à r.l. claiming that Amazon’s processing of personal data did not comply with the EU General Data Protection Regulation," the web goliath said in a financial filing accompanying its Q2 2021 earnings report
[1]PDF
on Thursday."The decision imposes a fine of €746m [$885m] and corresponding practice revisions."
[2]
Amazon said the CNPD decision has no merit and that it plans to challenge the ruling.
[3]
[4]
“Maintaining the security of our customers’ information and their trust are top priorities," Amazon said in a statement emailed to The Register . "There has been no data breach, and no customer data has been exposed to any third party. These facts are undisputed. We strongly disagree with the CNPD’s ruling, and we intend to appeal."
"The decision relating to how we show customers relevant advertising relies on subjective and untested interpretations of European privacy law, and the proposed fine is entirely out of proportion with even that interpretation."
[5]
The €746m fine is the largest penalty under the 2018 GDPR to date, surpassing the previous top penalty of €50m assessed by the French National Commission on Informatics and Liberty (CNIL) against Google in 2019 by almost 15x. In fact, Amazon's fine is more than twice the sum of all previous GDPR penalties combined ( [6]€303m ).
[7]Ex-Brave staffer launches GDPR sueball in Germany over tech giants' real-time bidding for ad inventory
[8]Truth and consequences for enterprise AI as EU know who goes legal: GDPR of everything from chatbots to machine learning
[9]Irish privacy watchdog sticks GDPR probe into Facebook after that online giveaway of 533 million profiles
[10]Can we exhale yet? EU set to rule UK 'adequate' for data sharing in post-Brexit GDPR move
The ruling follows from the CNPD's investigation of a May 28, 2018 complaint
[11]PDF
by [12]La Quadrature du Net , a French privacy group. The complaint contends that Amazon subjects website visitors to behaviorally targeted ads but fails to disclose this practice in its terms of use and fails to seek consent to use personal information to deliver targeted ads.The privacy group assailed Amazon's public statement about the absence of a data breach as a non sequitur, stating that the CNPD decision is a consequence of invasive ads rather than a database intrusion.
This historic fine hits straight to the heart of Big Tech’s predatory system, and should be celebrated as such
"It is the system of targeted advertising itself, and not merely occasional security breaches, that our legal action attacked," the group said in [13]a statement on its website. "This historic fine hits straight to the heart of Big Tech’s predatory system, and should be celebrated as such."
The privacy group also took the opportunity to contrast the massive CNPD fine with the failure of both the Irish Data Protection Authority and the CNIL to translate the group's complaints against Facebook, Apple, Microsoft and Google into meaningful penalties. And it celebrated the CNPD decision for restoring its faith in regulatory intervention.
"Business models based on domination and exploitation of our privacy and our free consent are disturbingly illegitimate and go against the values that our democratic societies claim to defend," the group said.
Elsewhere in its 10-Q filing, Amazon [14]reported $113.1bn in sales and an operating profit of $7.7bn for the quarter. ®
Get our [15]Tech Resources
[1] https://d18rn0p25nwr6d.cloudfront.net/CIK-0001018724/cbae1abf-eddb-4451-9186-6753b02cc4eb.pdf
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YQTK@vr5uDxoUdGZJPbZTQAAAE0&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YQTK@vr5uDxoUdGZJPbZTQAAAE0&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YQTK@vr5uDxoUdGZJPbZTQAAAE0&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YQTK@vr5uDxoUdGZJPbZTQAAAE0&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://dataprivacymanager.net/5-biggest-gdpr-fines-so-far-2020/
[7] https://www.theregister.com/2021/06/17/johnny_ryan_lawsuit_adtech/
[8] https://www.theregister.com/2021/04/19/ai_regulation_column/
[9] https://www.theregister.com/2021/04/15/irelands_top_data_privacy_watchdog/
[10] https://www.theregister.com/2021/02/15/uk_gdpr_adequacy/
[11] https://gafam.laquadrature.net/wp-content/uploads/sites/9/2018/05/amazon.pdf
[12] https://www.laquadrature.net/
[13] https://www.laquadrature.net/en/2021/07/30/amazon-fined-746-million-euros-following-our-collective-legal-action/
[14] https://www.theregister.com/2021/07/30/amazon_q2_2021/
[15] https://whitepapers.theregister.com/
Re: But will they actually have to pay?
A.P. Veening
Amazon can appeal, but the levels of appeal are pretty limited. Besides, the fine isn't the maximum possible fine yet and Amazon might also be convicted to pay the costs of the appeal.
Re: But will they actually have to pay?
Anonymous Coward
They might consider paying if it looks like it'll wind up costing them more than $899m to fight it somehow.
Re: But will they actually have to pay?
Yet Another Anonymous coward
These fines are really just a way of getting the companies to pay tax.
The politicians/voters like it because the tax cheats got taken down
The companies prefer it because they write it off against tax anyway and accounting tricks make it look like a one-off extraordinary payment, rather than a recurring tax bill - so the balance sheet looks better
But will they actually have to pay?
Don’t these things often get appealed and appealed until all the original members who brought the case or are involved in it die of old age before ultimately being forgotten or dismissed with merely a token slap on the wrist?