The Irish Data Protection Commission (DPC) has fined LinkedIn Ireland €310 million following an inquiry into its processing of personal data for behavioral analysis and targeted advertising. This inquiry, initiated by a complaint from the French Data Protection Authority, examined the lawfulness, fairness, and transparency of LinkedIn's data processing practices.
Key Findings
The DPC found LinkedIn in violation of several GDPR articles:
- Article 6 GDPR and Article 5(1)(a) GDPR: LinkedIn's processing of personal data was deemed unlawful as it did not validly rely on:
- Article 6(1)(a) GDPR (consent): The consent obtained was not freely given, sufficiently informed, specific, or unambiguous.
- Article 6(1)(f) GDPR (legitimate interests): LinkedIn's interests were overridden by the fundamental rights and freedoms of data subjects.
- Article 6(1)(b) GDPR (contractual necessity): LinkedIn's processing for behavioral analysis and targeted advertising did not meet the criteria for contractual necessity.
- Articles 13(1)(c) and 14(1)(c) GDPR: LinkedIn failed to provide adequate information regarding its reliance on the aforementioned legal bases.
- Article 5(1)(a) GDPR: LinkedIn violated the principle of fairness.
Corrective Measures
The DPC's final decision included:
- A reprimand under Article 58(2)(b) GDPR.
- Three administrative fines totaling €310 million under Articles 58(2)(i) and 83 GDPR.
- An order for LinkedIn to bring its processing into compliance with the GDPR under Article 58(2)(d).
Background
The inquiry, which began on August 20, 2018, was based on a complaint by the French non-profit La Quadrature Du Net. The complaint was initially made to the French Data Protection Authority and later transferred to the DPC, the lead supervisory authority for LinkedIn.
GDPR Compliance
The GDPR mandates that personal data processing must be based on one of the legal bases outlined in Article 6(1) GDPR, such as consent, contractual necessity, or legitimate interests. The consent must be freely given, specific, informed, and unambiguous. Furthermore, processing must be fair, not detrimental, discriminatory, unexpected, or misleading to the data subject. Transparency is essential to ensure data subjects are fully informed and can exercise their rights.
Conclusion
The DPC's decision underscores the importance of lawful, fair, and transparent processing of personal data. The full decision and further related information will be published by the DPC in due course.
