Irish Data Protection Commission Imposes €310 Million LinkedIn Fine

The decision was made by the DPC's Commissioners for Data Protection and notified to LinkedIn on 22 October 2024. The DPC submitted a draft decision to the GDPR cooperation mechanism under Article 60 in July 2024, and no objections were raised by other supervisory authorities.

What the DPC found

The DPC found infringements of Article 6 and Article 5(1)(a) of the GDPR on lawfulness. In its view, LinkedIn:

• did not validly rely on consent to process third-party data of its members for behavioural analysis and targeted advertising, because the consent was not freely given, sufficiently informed or specific, or unambiguous;
• did not validly rely on legitimate interests for processing first-party data for those purposes, or third-party data for analytics; and
• did not validly rely on contractual necessity to process first-party data for behavioural analysis and targeted advertising.

The DPC also found breaches of the transparency requirements in Articles 13(1)(c) and 14(1)(c) and of the principle of fairness. The fines were imposed in three parts totalling €310 million.

How the inquiry started

The inquiry began on 20 August 2018 after a complaint by the French non-profit organisation La Quadrature Du Net to the French data protection authority. The complaint was passed to the DPC as lead supervisory authority for LinkedIn. The full decision has been published by the DPC.

Why it matters

The decision addresses each of the main legal bases that platforms use for advertising-related processing. Businesses that rely on profiling for targeted advertising, including data received from third-party partners, may wish to review whether their chosen legal basis and privacy notices meet the standards applied by the DPC.

Sources

• Data Protection Commission: Irish Data Protection Commission fines LinkedIn Ireland €310 million
• Data Protection Commission: Inquiry into LinkedIn Ireland Unlimited Company, October 2024