The Irish Data Protection Commission (DPC) has fined LinkedIn Ireland €310 million after finding significant breaches of the GDPR.
The investigation, sparked by a complaint from French nonprofit La Quadrature Du Net, scrutinized LinkedIn’s data practices—specifically its use of user’s personal data for behavioral analysis and targeted advertising on the platform.
The complaint was initially made to the French Data Protection Authority and then redirected to the DPC, which acts as the lead supervisory authority for LinkedIn within the EU.
The verdict includes a formal reprimand, a mandate for LinkedIn to overhaul its data practices, and three administrative fines that sum up to €310 million.
Behind the Decision: How LinkedIn’s Data Practices Fell Short
- Article 6 and Article 5(1)(a): LinkedIn failed to ensure lawful processing of personal data by:
- Consent (Article 6(1)(a)): LinkedIn’s reliance on consent for processing third-party data of its members for behavioral analysis and targeted advertising was invalid. The consent obtained was not freely given, sufficiently informed, specific, or unambiguous.
- Legitimate Interests (Article 6(1)(f)): LinkedIn could not rely on legitimate interests for processing members’ personal data or third-party data for analytics and advertising purposes, as the interests and fundamental rights of the data subjects outweighed LinkedIn’s.
- Contractual Necessity (Article 6(1)(b)): LinkedIn also improperly relied on contractual necessity as a lawful basis to process members’ personal data for behavioral analysis and targeted advertising.
- Articles 13(1)(c) and 14(1)(c) GDPR: LinkedIn failed to adequately inform data subjects about its reliance on consent, contractual necessity, and legitimate interests as legal grounds for processing.
- Article 5(1)(a) GDPR (Fairness Principle): LinkedIn’s data processing practices did not meet the principle of fairness.
DPC Deputy Commissioner Graham Doyle emphasized that data processing without a valid legal basis represents a serious infringement on individual privacy rights: “The lawfulness of processing is fundamental to data protection, and any failure to adhere compromises individuals’ control over their personal data.”
Key Takeaways from the LinkedIn Case
The decision underscores the importance of transparency, fairness, and informed consent in data handling.
Under the GDPR, processing personal data must be based on a lawful basis, such as consent, contract, or legitimate interests. Each basis has specific conditions; for example, consent must be freely given, specific, informed, and unambiguous.
The principle of fairness requires that personal data is processed in a manner that is not detrimental, discriminatory, unexpected, or misleading to data subjects. A lack of fairness can undermine individuals’ autonomy over their data and hinder their ability to exercise their rights under the GDPR.
Transparency is essential for empowering data subjects, ensuring they are informed about the processing of their personal data and can exercise their rights effectively. Compliance with transparency requirements enables individuals to understand the implications of data processing before it occurs.
Without these cornerstones, individuals are left with little control over their data—a risk the GDPR was designed to counter.
Corrective Actions and Next Steps
As part of its ruling, the DPC imposed three critical corrective measures:
- A Formal Reprimand under Article 58(2)(b) GDPR;
- Administrative Fines Totaling €310 Million in line with Articles 58(2)(i) and 83 GDPR; and
- A Compliance Order requiring LinkedIn to align its practices with GDPR standards, per Article 58(2)(d).
The Bigger Picture
This case highlights a shift towards stringent enforcement of data privacy standards in the EU, reflecting regulators’ increasing focus on corporate accountability. The DPC’s decision serves as a strong reminder: companies must prioritize user rights, or face substantial repercussions.
Data Privacy Manager
Data Privacy Manager (DPM) is an innovative SaaS platform designed to automate privacy processes and support cross-departmental cooperation, ensuring compliance with regulations and minimizing privacy-related risks.
DPM consists of 4 products and 11 modules, each addressing one of the key challenges organizations face when getting their data processing into compliance.
The solution features a visual dashboard that provides continuous insight into all processing activities, making it easy for organizations to maintain a clear view of their privacy program.
