EU fines LinkedIn $334 million for violating the GDPR
Ireland’s Data Protection Commission has imposed a fine of $335 million on LinkedIn Ireland for unlawfully processing the personal data of users in the European Union for the purpose of targeted advertising.
The ruling also mandates that LinkedIn, owned by Microsoft Corp., must align its data processing practices with the EU’s General Data Protection Regulation (GDPR), as stated by the Irish Data Protection Commission on Thursday. Deputy Commissioner Graham Doyle emphasized that LinkedIn’s handling of personal data without a valid legal basis constitutes a “clear and serious violation of data subjects’ fundamental right to data protection.”
LinkedIn indicated that the case pertains to allegations from 2018 regarding certain aspects of its digital advertising strategies within the EU.
“Although we believe we have adhered to the General Data Protection Regulation (GDPR), we are committed to ensuring that our advertising practices comply with the IDPC’s deadline,” a spokesperson remarked in a statement.
The inquiry into LinkedIn’s data processing practices was initiated by Ireland’s Data Protection Commission following a complaint lodged with the French data regulator. As many major technology firms have their European headquarters in Ireland, local regulators are responsible for enforcing EU regulations.
LinkedIn is currently facing a fine of €310 million ($334 million) imposed by the European Union, following a determination by the Irish Data Protection Commission (DPC) that the company improperly conducted behavioral analyses of its members’ personal data for the purpose of targeted advertising. The ruling asserts that LinkedIn breached the General Data Protection Regulation (GDPR) by failing to secure appropriate consent, demonstrate legitimate interest, or establish a contractual necessity for processing the data collected by itself and third parties.
Additionally, the DPC issued a reprimand to LinkedIn and mandated that the company ensure all data collection practices are compliant with legal standards. “The lawfulness of processing is a fundamental aspect of data protection law, and processing personal data without a valid legal basis constitutes a significant violation of individuals’ fundamental rights to data protection,” stated Graham Doyle, Deputy Commissioner of the DPC.
This decision originated from a complaint lodged in 2018 by the French non-profit organization La Quadrature Du Net, which prompted an initial investigation into whether LinkedIn was processing user data in a lawful, fair, and transparent manner. The issue was initially raised with the French Data Protection Authority before being referred to the DPC, given that LinkedIn’s European headquarters is located in Ireland.
In response to the ruling, a LinkedIn spokesperson provided a statement to Engadget: “Today, the Irish Data Protection Commission (IDPC) reached a final decision regarding claims from 2018 concerning some of our digital advertising practices in the EU. While we believe we have adhered to the General Data Protection Regulation (GDPR), we are committed to ensuring that our advertising practices align with the IDPC’s decision by the specified deadline.”
