Inquiry into LinkedIn Ireland Unlimited Company - October 2024

• Year: 2024
• Date: 22 October 2024
• Section: Decisions made under data protection act 2018

Inquiry into LinkedIn Ireland Unlimited Company - October 2024

(IN-18-08-3) Date of Decision: 22 October 2024

The Decision concerns an Inquiry by the Data Protection Commission (the DPC) into LinkedIn Ireland Unlimited Company (LinkedIn), a data controller with its main establishment in Ireland. The Decision relates to a complaint-based inquiry, which was commenced on 20 August 2018, following a complaint made by the French non-profit organisation, La Quadrature Du Net (the Complaint).

The Complaint was initially made to the French Data Protection Authority, on behalf of affected data subjects pursuant to Article 80(1) GDPR, and later transmitted to the DPC as lead supervisory authority for LinkedIn. The Complaint asserted that LinkedIn had processed certain personal data relating to the data subjects, for the purposes of behavioural analysis and targeted advertising (BA & TA), without a valid legal basis and in an unfair and non-transparent manner.

The DPC commenced a statutory inquiry (the Inquiry), on 20 August 2018, to examine LinkedIn’s compliance with Articles 5(1)(a), 6(1), 13(1)(c), 13(1)(d), 14(1)(c) and 14(2)(b) of the GDPR. The inquiry was commenced pursuant to Section 110 of the Data Protection Act 2018 (the 2018 Act).

Summary of Findings

The Decision concluded that:

• LinkedIn could not validly rely on Article 6(1)(a) GDPR to process third party data of its members for the purpose of BA & TA, excluding analytics, on the basis that the consent obtained by LinkedIn was not freely given, sufficiently informed or specific, or unambiguous.
• LinkedIn could not validly rely on Article 6(1)(f) GDPR for its processing of first-party data personal data of its members for BA and TA or third party data for analytics.
• LinkedIn could not validly rely on Article 6(1)(b) GDPR to process first party data of its members for the purpose of BA & TA.
• LinkedIn infringed Article 13(1)(c) and 14(1)(c) in respect of the information it provided to data subjects regarding its reliance on Article 6(1)(a), Article 6(1)(b) and Article 6(1)(f) as lawful bases.
• LinkedIn infringed the principle of fairness in Article 5(1)(a) GDPR.

Corrective Measures

Under Section 113(4)(a) of the 2018 Act, where the DPC adopts a decision (in accordance with Section 113(2)(b)), it must, in addition, make a decision as to whether a corrective power should be exercised in respect of the controller or processor concerned and, if so, the corrective power to be exercised. Article 58(2) GDPR...