Data Protection Commission fines LinkedIn €310m

Social network hit over practice of ad targeting without consent

Trade

Image: Shutterstock via Dennis

24 October 2024

The Data Protection Commission has today announced a fine of €310 million for LinkedIn, following a complaint initially made to the French Data Protection Authority. Under the terms of the GDPR the complaint was processed in Ireland, where the social network has its European base.

The inquiry examined LinkedIn’s processing of personal data for the purposes of behavioural analysis and targeted advertising of users who have created LinkedIn profiles.

The decision, which was made by the Commissioners for Data Protection, Dr Des Hogan and Dale Sunderland, and notified to LinkedIn on 22 October 2024, concerns the lawfulness, fairness and transparency of this processing. The fine is accompanied by a reprimand and an order for LinkedIn to bring its processing into compliance.

The DPC submitted a draft decision to the GDPR cooperation mechanism in July 2024. No objections to the DPC’s draft decision were raised. The DPC does has experience of its decisions being disputed, most recently in the case of Meta Platforms where the regulator accepted the social network’s ‘pay or ok’ policy of forcing users to pay a subscription to avoid ad targeting. This was overruled by the European Data Protection Board.

Ireland also has a history of slow enforcement of GDPR against Big Tech. The decision against Microsoft-owned LinkedIn may go some distance towards discarding the perception of the regulator as a soft touch in a country reliant on multinationals.

DPC Deputy Commissioner Graham Doyle said: “The lawfulness of processing is a fundamental aspect of data protection law and the processing of personal data without an appropriate legal basis is a clear and serious violation of a data subjects’ fundamental right to data protection.”

A statement from LinkedIn read: “Today the Irish Data Protection Commission (IDPC) reached a final decision on claims from 2018 about some of our digital advertising efforts in the EU. While we believe we have been in compliance with the General Data Protection Regulation (GDPR), we are working to ensure our ad practices meet this decision by the IDPC’s deadline.”

The full decision will be released at a later date.

TechCentral Reporters