On July 16 2021, the Luxembourg Data Protection Agency finally rendered its opinion on the collective legal action we and 10 000 more people took in May 2018 against Amazon. This decision breaks a three-year silence which had started to make us expect the worst.
The decision, revealed by Bloomberg, suffers from no ambiguity: the targeted ad system that Amazon forces onto us is not based on free consent, which is a violation of the GDPR. As such, the corporation is fined to the tune of 746 million euros. This is a new European record for breaching GDPR rules (the previous high-mark was the 50 million euros fine the CNIL, the French DPA, levied against Google, again as a result of our collective legal action).
Amazon’s reaction to this historic sanction is to complain to Bloomberg, pretending to not understanding what is at stake: “There has been no data breach, and no customer data has been exposed to any third party”. Rightly so: it is the system of targeted advertising itself, and not merely occasional security breaches, that our legal action attacked. This historic fine hits straight to the heart of Big Tech’s predatory system, and should be celebrated as such.
This “party is over” sanction puts in even starker contrast the blatant abdication of the Irish Data Protection Agency who, in three years, was not able to close a single one of the four other actions we lodged against Facebook, Apple, Microsoft and Google.
The Luxembourgish authority’s position is also a cold shower for the French CNIL who, for a long time, stood as the data protection champion in the European landscape. Today, the CNIL is but a shadow of its former self: our collective actions were initially lodged before it and would have given it a perfect opportunity to take the reigns of enforcing the GDPR against the systemic violations of personal data and privacy, which lie at the heart of the business model of the Web Giants.
Just as we were starting to fear that any useful legal action against Big Tech had become impossible, hope came from Luxembourg (not something we had anticipated!), taking our motivation back to our 2018 levels. Business models based on domination and exploitation of our privacy and our free consent are disturbingly illegitimate and go against the values that our democratic societies claim to defend. We will keep fighting this domination, with your help.