Amazon has been fined 746 million Euro by the Luxembourg DPA (where Amazon’s EU activities reside). In its response Amazon shows it isn’t willing to publicly acknowledge to even understand the EU data protection rules.
There has been no data breach, and no customer data has been exposed to any third party. These facts are undisputed., said an Amazon spokesperson according to Techcrunch.
Those facts are of course undisputed because a data breach or exposure of data to third parties is not a prerequisite for being in breach of GDPR rules. Using the data yourself in ways that aren’t allowed is plenty reason in itself for fines the size of a few percentage points of your global yearly turnover. In Amazon’s case the fine isn’t even a third of a percentage point of their turnover, so about a day’s worth of turnover for them: they’re being let-off pretty lightly actually compared to what is possible under the GDPR.
How Amazon uses the data it collects, not any breach or somesuch, is the actual reason for the complaint by La Quadrature du Net (PDF) filed with the Luxembourg DPA: the complaint “alleges that Amazon manipulates customers for commercial means by choosing what advertising and information they receive.” (emphasis mine)
The complaint and the ruling are laying bare the key fact Amazon and other tech companies aren’t willing to publicly comment upon: adtech in general is in breach of the GDPR.
There are a range of other complaints along these lines being processed by various DPA’s in the EU, though for some of those it will be a long wait as e.g. the Irish DPA is working at a snail’s pace w.r.t. complaints against Apple and Facebook. (The slow speed of the Irish DPA is itself now the subject of a complaint.)
Meanwhile two new European laws have been proposed that don’t chime with the current modus operandi of Amazon et al, the Digital Markets Act and the Digital Services Act, which both contain still bigger potential fines than the GDPR for non-compliance w.r.t. e.g. interoperability, service-neutrality, and transparency and accountability measures. And of course there are the European anti-trust charges against Amazon as well.
Amazon will of course appeal, but it can only ever be an attempt to gaslight and gloss over the fundamental conflict between adtech and GDPR. Let’s hope the Luxembourg DPA continues to see through that.
Thanks for posting.
The Irish Data Protection Authority (DPA), has issued a decision on a 2018 investigation into WhatsApps data processing. It concerned at first glance two aspects, one the uploading of WhatsApp user’s contact lists, and the retention of non-user (hashed) phone numbers, as well as the information exchange between WhatsApp and its parent company Facebook. WhatsApp argued they were not a data controller in this case, but their users were, and they were merely processing data, but that defense failed. (I think the language used by WhatsApp itself, the word ‘user’, gives away the actual locus of power quite clearly.)
The An Coimisiúm um Chosaint Sonraí, Irish Data Protection Commission, issued a fine of 225 million Euro’s. This seems right up there at the top of the potential fine range of 4% of global turnover in the last year (2020).
It is good to see the Irish DPA finally coming down with a decision. With enforcement of the GDPR starting mid 2018, a range of complaints and investigations landed on the Irish DPA’s plate, as several large tech companies maintain their EU presence in Ireland. The slow pace of the Irish DPA in handling these complaints has been itself a source of complaints. With this decision on the WhatsApp investigation there now finally is some visible movement.
Also see the earlier announcement concerning Amazon receiving a 746 million fine from the Luxembourg DPA.