Amazon is reportedly facing the largest GDPR fine on record (€350 Million) following an investigation by the Luxembourg data protection authority into how the online giant is using customer data without consent.
According to The Wall Street Journal, Luxembourg’s National Commission for Data Protection (Commission Nationale pour la Protection des Données) has circulated a draft decision on the fine, although it is claimed that some member states believe the penalty should be increased.
The investigation was conducted in Luxembourg as Amazon’s European HQ is based in the country. It investigated whether Amazon was using customer data to inform targeted advertising without their permission through its online shopping site.
An Amazon spokesman declined to comment. The company has previously said the privacy of its customers is a priority and it complies with the law in all countries where it operates. A spokesman for the CNPD said the regulator wasn’t allowed to comment on individual cases.
The practice so far has shown that the amounts of fines for violating the GDPR after the implementation of all procedures are still lower than those initially announced by the supervisory authorities. Whether this will be the case this time remains to be seen.