LinkedIn Fined $506M For Illegally Processing Personal Data

LinkedIn, which has around a billion members globally – including 15 million in Australia – has been fined by regulators for illegally processing the personal data of some users.

Ireland’s Data Protection Commission (DPC) has fined the Microsoft-owned company A$505.8 million for illegally processing the personal data of users within the European Union with the aim of delivering targeted advertising.

The order included the DPC instructing the job search and professional networking platform to bring its data processing “into compliance” with the EU’s General Data Protection Regulation.

“The lawfulness of processing is a fundamental aspect of data protection law and the processing of personal data without an appropriate legal basis is a clear and serious violation of a data subject’s fundamental right to data protection,” said Graham Doyle, DPC Deputy Commissioner.

The DPC contended that its investigation found that LinkedIn did not have a lawful basis to gather data that allowed it to target users with online ads, which is a breach of the EU’s privacy rules known as General Data Protection Regulation.

It slammed LinkedIn saying that the consent to process third party data of its members “was not freely given, sufficiently informed or specific, or unambiguous.”

It also stated that LinkedIn’s interests to process the first party personal data of its members “were overridden by the interests and fundamental rights and freedoms of data subjects.”

The DPC’s decision stems from a complaint-based inquiry, which was commenced over six years ago in August 2018, following a complaint made by the French non-profit organisation, La Quadrature Du Net.

That complaint was initially made to the French Data Protection Authority and thereafter provided to the DPC in its role as the lead supervisory authority for LinkedIn, which acts as the controller for the processing of personal data. LinkedIn has its European headquarters in Ireland, which means that the country’s local regulators are tasked with enforcing EU rules.

Following the DPC’s decision to fine it, a LinkedIn spokesperson said, “While we believe we have been in compliance with the General Data Protection Regulation, we are working to ensure our ad practices meet this decision by the IDPC’s deadline.”

LinkedIn’s practices in Australia may come under greater scrutiny where the platform reportedly had 16 per cent more Australian job applications in 2023 than 2022 and has more than half the country’s population using it.

In Australia, profiles can be verified through an employer, an academic institution or by submitting a passport via Persona. Members who undergo the free verification process are ‘rewarded’ with a verified badge on the platform.