Data Protection Commission Reference: IN-18-08-3
In the matter of LinkedIn Ireland Unlimited Company
Summary of Draft Decision of the Data Protection Commission
The Decision concerns an Inquiry by the Data Protection Commission (the ‘DPC’) into LinkedIn Ireland
Unlimited Company (‘LinkedIn), a data controller with its main establishment in Ireland. The Decision
relates to a complaint-based inquiry, which was commenced on 20 August 2018, following a complaint
made by the French non-profit organisation, La Quadrature Du Net (‘the Complaint’).
The Complaint was initially made to the French Data Protection Authority, on behalf of affected data
subjects pursuant to Article 80(1) GDPR, and later transmitted to the DPC as lead supervisory authority
for LinkedIn. The Complaint asserted that LinkedIn had processed certain personal data relating to the
data subjects, for the purposes of behavioural analysis and targeted advertising (‘BA & TA’), without a
valid legal basis and in an unfair and non-transparent manner.
The DPC commenced a statutory inquiry (‘the Inquiry’), on 20 August 2018, to examine LinkedIn’s
compliance with Articles 5(1)(a), 6(1), 13(1)(c), 13(1)(d), 14(1)(c) and 14(2)(b) of the GDPR. The inquiry
was commenced pursuant to Section 110 of the Data Protection Act 2018 (‘the 2018 Act’).
Material and Temporal Scope of the Decision
Background
The subject matter of the Decision concerns LinkedIn’s processing of the personal data of members of the
LinkedIn platform for the purposes of BA & TA. Behavioural analysis, in this context, is the entire process
whereby information provided by, inferred from or observed about an individual is used to inform the
advertisements that are targeted to that individual, or is aggregated with other information for the
purpose of conducting targeted advertising. Targeted advertising, in turn, is the process by which specific
advertisements are targeted to an individual, based on information which is held about the individual
(whether directly provided by them or inferred and/or observed about them) or targeting criteria which
have been developed based on such information. Broadly speaking, LinkedIn conducted BA and TA based
on (i) data submitted by members or created as a result of their use of the LinkedIn platform (‘first party
data’); and (ii) data that was provided to LinkedIn by its enterprise customers (‘third party data’).
Additional details on those data sources are set out below.
1
Third party data
Third party data, in this context, is data that was obtained by LinkedIn by way of its LinkedIn Marketing
Solutions (‘LMS’) customers’ use of the ‘LinkedIn Insight tag’ on their websites. The LinkedIn Insight Tag is
a piece of code that sends a signal, via a HTTP call, to LinkedIn when a user visits the website of a LinkedIn
LMS customer that has an Insight Tag placed on it. The signal received via the Insight Tag also provides
LinkedIn with access to LinkedIn cookies, if any, present on a member’s browser.
If LinkedIn could subsequently match the data received to a LinkedIn member, and if the member had
provided consent for the use of third party data for ad targeting, this allowed LinkedIn to place members
into a targeting group for that third party LMS customer so that they may be re-targeted with ads, both
on and off the LinkedIn platform. Alternatively, if there was a match, and if the member did not provide
consent for the use of third party data for ad targeting, LinkedIn used this information to provide its LMS
customers with aggregated analytics reports. Those reports then allowed those third parties to further
refine their advertising campaigns and more effectively target LinkedIn members based on their first party
data.
The overall purpose of analytics carried out using the Insight Tag was to allow LinkedIn’s customers to
conduct BA & TA based on third party data. Behavioural analysis includes both analysis of specific
individuals’ behaviour and aggregating information about more than one individual to conduct targeted
advertising. On this basis, the DPC concluded that the analytics carried out by LinkedIn using the Insight
Tag, and provided to its customers to target members based on first-party data, also fell under the heading
of BA & TA as defined above and, accordingly, within the scope of the Inquiry.
First party data
The first-party data processed by LinkedIn consisted of:
• Data that LinkedIn members provided directly to LinkedIn in their profiles; and
• Inferences that LinkedIn drew from the information members provided on their profiles (e.g.
gender or age), their actions taken on LinkedIn, and actions by similar members.
LinkedIn placed members into segments based on this data. For example, a member with a listed field of
study as law would be placed in the law segment under the fields of study category.
2
In addition to the above, between March 2019 and March 2023 LinkedIn placed a set of members into
interest categories based on interest categories that they had been placed into by Bing through their use
of the search engine. LinkedIn obtained that interest category data and mapped it to LinkedIn’s own
interest categories (LinkedIn did not receive any specific data based on searches from Bing). While
LinkedIn sought to classify this data as first party data, and based its processing on the lawful basis relied
on for such processing (as detailed below), the DPC did not accept that LinkedIn had accurately classified
this data as first party data.
Temporal Scope
The temporal scope of the Decision considered LinkedIn’s processing of data as it existed at two points -
28 May 2018 and 14 September 2020. The first point in time is the date on which the complaint was made.
The second point in time is the date of the DPC’s first correspondence to LinkedIn after its cessation of
reliance on the contractual necessity lawful basis under Article 6(1)(b) GDPR, as a lawful basis for
processing first party personal data, as detailed below.
Lawful bases relied upon by LinkedIn
The following table sets out the lawful bases relied upon by LinkedIn for processing which fell within the
scope of this Inquiry and Decision:
Processing operation and Lawful basis relied on as of 28 Lawful basis relied on as of 14
purpose May 2018 September 2020
Processing of first party Contractual necessity (Article Legitimate interests (Article
personal data of members for 6(1)(b) GDPR) 6(1)(f) GDPR)
behavioural analysis and
targeted advertising (excluding Legitimate interests (Article
analytics) 6(1)(f) GDPR)
Processing of third party Consent (Article 6(1)(a) GDPR) Consent (Article 6(1)(a) GDPR)
personal data of members for
behavioural analysis and
targeted advertising (excluding
analytics)
Processing of third party Legitimate interests (Article Legitimate interests (Article
personal data of members for 6(1)(f) GDPR) 6(1)(f) GDPR)
analytics
3
Having regard to the background above, the following sections contain an overview of the infringements
found in the Decision, under the relevant headings of lawfulness, fairness, and transparency.
Lawfulness
(i) Consent
LinkedIn members in the EU were by default opted-out of the use of third party data for ad targeting by
25 May 2018. They were thereafter presented with an in-product notification (shown below), giving them
the option to consent to the use of third party data for ad targeting or to remain opted-out.
[Figure 1 – LinkedIn in-product notification]
In order for consent to be valid under the GDPR it must be: (1) freely given, (2) specific, (3) unambiguous,
(4) as easy to give as to withdraw, and (5) informed. The DPC conducted a detailed examination of the
consent obtained with reference to each of those criteria and concluded that the consent obtained by
LinkedIn was not freely given, specific, informed or unambiguous.
With regard to the freely given nature of the consent, the DPC concluded that the perception of detriment
created by LinkedIn’s consent tool led to an element of inappropriate pressure and influence on data
4
subjects to consent by clicking on the “Accept & Continue” button. In particular, the wording used in the
consent tool implied that if they did not provide consent in the manner sought, this would negatively
impact their ability to see relevant jobs on the platform beyond simply not seeing paid-for advertisements
relating to jobs.
With regard to the informed and specific nature of the consent, the DPC found that the information
accompanying the consent mechanism relied upon by LinkedIn did not sufficiently enable data subjects
to “determine easily the consequences of any consent” they were being requested to give, as is required
for valid consent in line with CJEU case law. In particular, an insufficient level of detail was provided
regarding the advertising technologies used by LinkedIn and in relation to the roles of the various third
party advertising partners and publishers that it worked with. In addition, the DPC concluded that the
distinction between the manner in which members would receive targeted advertising (i.e., on or off the
LinkedIn platform), in terms of the processing operations, technologies and data used, and partners
involved, was imprecise. The relevant information was also not provided in a sufficiently granular manner
with the result that it may have been misleading to data subjects. The finding of the DPC was further
supported by LinkedIn’s reliance on multiple lawful basis for the processing of third party data for BA &
TA. In this regard, members were not informed when providing consent, that if they did not provide such
consent, LinkedIn would still process this data in order to provide analytics reports to its enterprise
customers on the basis of an asserted legitimate interest. As a result of those flaws, it could not be
considered that the consent obtained by way of the consent seeking mechanism was sufficiently informed
or specific within the meaning of the GDPR.
With regard to the unambiguous nature of the consent, it is imperative that controllers develop consent
mechanisms that are clear to data subjects, avoid ambiguity, and ensure that the action by which consent
is given can be distinguished from other actions. The DPC concluded that that standard was not met in
this case. While active behaviour was required on the part of data subjects, the articulation of the options
presented to users – “Accept & Continue” v “Manage Settings” – introduced ambiguity and nudged data
subjects into accepting in order to continue. In addition to the ambiguity of the composite phrase “Accept
& Continue”, as set out above, while placed side-by-side, both options were not given equal prominence
from a visual perspective. While the buttons appeared to be equal in size, the “Accept & Continue” button
was blue and prominent against the white background of the user engagement flow. Conversely the
“Manage Settings” button was the same colour as the background of the in-product notification and more
difficult to distinguish by comparison
(ii) Legitimate interests
Article 6(1)(f) GDPR provides that processing shall be lawful to the extent that processing is necessary for
the purposes of the legitimate interests pursued by the controller or by a third party, except where such
interests are overridden by the interests or fundamental rights and freedoms of the data subject, which
require protection of personal data, in particular where the data subject is a child.
5
According to the case-law of the CJEU, three conditions must be satisfied in order for a controller to be
able to rely on legitimate interests as a lawful basis for the processing of personal data: (a) the pursuit of
a legitimate interest by the controller or by a third party; (b) the need to process personal data for the
purposes of the legitimate interests pursued; and (c) whether the interests or fundamental rights and
freedoms of the data subject override the legitimate interest pursued.
The DPC agreed with LinkedIn that the establishment, conduct and provision of LinkedIn’s business and
services, which enabled and assisted LinkedIn’s members, guests, other subjects and customers to access
and provide services, assemble and associate, express themselves and access educational and business
opportunities, were legitimate interests. In this context, the BA & TA carried out by LinkedIn helped its
customers to target individuals, which in turn generated an income by helping to ensure that the
advertisements on its services reached the most appropriate audience. Both LinkedIn’s interests and
Members’ and third party interests thus met the first stage of the test, i.e. they met the definition of
legitimate interests for the purposes of the GDPR. Additionally, regarding the second stage of the test, the
DPC accepted that LinkedIn had demonstrated that, at the time of the Inquiry, there were no less
restrictive means of achieving the interests in question that could equally effectively achieve the aim
pursued.
Turning to the third part of the test, which requires a case-by-case balancing of the opposing rights and
interests concerned, while taking account of the significance of the data subject’s rights arising from
Articles 7 and 8 of the Charter, the DPC concluded that LinkedIn had not struck the appropriate balance.
The DPC acknowledged that the LinkedIn platform contributed to a number of positive public interests,
such as allowing employees and job seekers to advertise their skills to a large employer audience,
providing opportunities for up-skilling and re-skilling, and matching job seekers to job opportunities that
best fit their interests and reducing search costs (including time). The DPC therefore afforded some weight
to those benefits.
However, the DPC identified a range of negative impacts on data subjects, including: (i) the likelihood that
a data subject would be incorrectly segmented on the basis of erroneously inferred data and would then
be presented with advertising that is of no relevance as a result of extensive processing of potentially
inaccurate personal data; (ii) the large number of segments and large number of inferences that may be
drawn about users; (iii) the extensive use of inferred categories of data and the particularly concerning
possibility that, in a professional context, a data subject could be targeted, or perhaps more
problematically, excluded, from job advertisements based on inferred data which would be inappropriate
factors to consider in a professional context (such as gender or age); (iv) and the use of interest categories
derived from members’ activities on Bing, which was particularly intrusive.
In addition, the DPC concluded that the processing conducted by LinkedIn was not in the reasonable
expectations of users. The DPC acknowledged that most data subjects using a social media platform would
6
expect some form of targeted ads. However, this did not extend to the use of certain inferred data
categories in a professional context (such as gender or age), the use of Bing data, or the use of analytics
reports (which were based on third party data, including in circumstances where data subjects had
declined to provide consent for the use of their third party data for BA & TA) to better target users based
on first party data. While the DPC acknowledged that the disclosures made in LinkedIn’s Privacy Policy
were relevant to the assessment of whether particular processing activities were within the reasonable
expectations of users, in line with EDPB Guidelines, the disclosures made by LinkedIn in its Privacy Policy
could not be determinative of whether the processing of inferred age and gender-related data for the
purposes of BA & TA was within the reasonable expectations of users. In addition, the references to Bing
data - contained only in users advertising settings - and general references to data obtained from
Microsoft in the Privacy Policy, were not sufficient to bring the processing of Bing data within the
reasonable expectations of users.
Considering the factors identified above, and all of the processing in the round, the DPC did not consider
that the provisional balance favoured LinkedIn’s processing of personal data for LinkedIn’s interests or
Members’ and third party’s interests. While the DPC agreed that the LinkedIn platform contributed to
certain positive public interests, these interests were outweighed by the impact on data subjects. The
processing had an impact on the rights and freedoms of data subjects, was intrusive in nature, and given
the volume of information collected about individuals, which went beyond data solely relating to an
individual’s professional life, such as inferred age and gender, was not within the reasonable expectations
of data subjects within a professional context.
The DPC took note of a number of additional measures and safeguards provided by LinkedIn. This
included: pseudonymisation measures employed in relation to third-party data LinkedIn received from
LMS customers’ insight tags and restrictions on micro-targeting; policies to restrict discriminatory
practices in advertising; and enabling unconditional opt outs. However, while the disclosures made by
LinkedIn, the opt-outs, the security measures and advertising policies, must be factored in when
considering the final balance, given the weaknesses and caveats identified, the DPC did not consider that
these measures were sufficient to tip the balance in favour of LinkedIn’s reliance on the legitimate
interests legal basis. As a result, the DPC concluded that the interests and fundamental rights and
freedoms of the data subject outweighed the legitimate interests of LinkedIn and that LinkedIn did not
validly rely on Article 6(1)(f) GDPR.
(iii) Contractual necessity
Article 6(1)(b) provides for a lawful basis for processing to the extent that processing is necessary for the
performance of a contract to which the data subject is party or in order to take steps at the request of the
data subject prior to entering into a contract.
7
In January 2020, LinkedIn ceased its reliance on Article 6(1)(b) as a lawful basis for processing first party
personal data for targeted advertising. From that point, LinkedIn relied exclusively on Article 6(1)(f) as a
lawful basis for such processing. Notwithstanding such cessation, the DPC considered whether, as at the
date of the Complaint, on 28 May 2018, LinkedIn was validly relying on Article 6(1)(b) as the legal basis for
processing first party personal data of members for the purposes of conducting BA & TA.
In this regard, and in line with EDPB guidance, the DPC considered whether LinkedIn’s processing of the
data of its members for the purposes of BA & TA was objectively necessary for the performance of the
User Agreement in place between it and its members and formed part of the “core bargain” struck
between LinkedIn and its members. According the previous EDPB guidance (Guidelines 02/2019), the
“necessary for the performance of a contract” ground must be interpreted strictly and does not cover
situations where the processing is not genuinely necessary for the performance of a contract, but rather
unilaterally imposed on the data subject by the controller. In this respect, the EDPB has previously
concluded that in assessing necessity, “it is important to determine the exact rationale of the contract, i.e.
its substance and fundamental objective, as it is against this that it will be tested whether the data
processing is necessary for its performance”. Guidelines 02/2019 thus set out a restrictive view on when
processing should be deemed to be necessary for the performance of a contract, and explicitly refers to
personalised advertising as an example of processing that will usually not be necessary. This is, however,
a general rule, and not an absolute rule.
Consistent with this guidance, the CJEU has also previously held that the fact that such processing may be
referred to in the contract or may be merely useful for the performance of the contract is, in itself,
irrelevant in that regard (see Case C-252/21 Bundeskartellamt). The decisive factor for the purposes of
applying the justification is rather that the processing of personal data by the controller must be essential
for the proper performance of the contract concluded between the controller and the data subject and,
therefore, that there are no workable, less intrusive alternatives. With regard to the justification based
on personalised content, the CJEU concluded that “although such a personalisation is useful to the user,
in so far as it enables the user, inter alia, to view content corresponding to a large extent to his or her
interests, the fact remains that, subject to verification by the referring court, personalised content does
not appear to be necessary in order to offer that user the services of the online social network”.
In the present circumstances, and in light of this guidance and case law, the DPC, having carefully
considered the terms of both the User Agreement and the Privacy Policy, concluded that, BA & TA could
not be considered to form part of the core bargain between LinkedIn and its members. In particular, it
was open to members to opt out of all of the relevant processing and continue to use the service. In the
DPC’s view, this was a recognition by LinkedIn that the core purposes of the contract could be fulfilled
without processing personal data for BA & TA. While targeted advertising was mentioned in section 2.4
of LinkedIn’s Privacy Policy, there was no indication that this was fundamental to the provision of services
by LinkedIn to its members. Indeed, LinkedIn’s services could be provided to members in the form of an
equivalent alternative which did not involve ad personalisation, as occurs when members opt out of
8
receiving personalised ads. Accordingly, the DPC considered that there was a “workable, less intrusive
alternative” to processing personal data for the purpose of BA and TA, within the meaning of the CJEU
Bundeskartellamt judgment.
With regard to the concept of necessity, the DPC equally did not consider that processing of first party
data for BA & TA could be considered necessary for the performance of the User Agreement. In this regard,
the DPC noted that the Privacy Policy described processing for the purposes of ads and personalisation in
terms that fell far short of necessity and made clear that any processing of personal data for the purposes
of BA & TA was subject to a member’s personal settings. Accordingly, the DPC found that the processing
of first party data for BA & TA was not the least intrusive way that LinkedIn could have provided services
to its members. That processing was not necessary in order to provide the specific service in question to
LinkedIn’s members.
As a result, as of the time of the Complaint, LinkedIn could not validly rely on Article 6(1)(b) as a lawful
basis for the processing of first party data for the purposes of BA and TA.
Transparency
Articles 13(1)(c) and 14(1)(c)
Article 13(1)(c) states, inter alia, that:
Where personal data relating to a data subject are collected from the data subject, the controller
shall, at the time when personal data are obtained, provide the data subject with all of the
following information:
[…]
(c) the purposes of the processing for which the personal data are intended as well as the legal
basis for the processing
Article 14(1)(c) GDPR states as follows:
Where personal data have not been obtained from the data subject, the controller shall provide
the data subject with the following information:
[…]
(c) the purposes of the processing for which the personal data are intended as well as the legal
basis for the processing.
Articles 13(1)(c) and 14(1)(c) therefore provide for the provision of the same information concerning data
obtained directly from data subjects and data obtained from third parties. Article 12(1) GDPR sets out the
manner in which a controller must provide information referred to in Articles 13 and 14 i.e. “in a concise,
transparent, intelligible and easily accessible form, using clear and plain language”. In the present
circumstances, the DPC concluded that Article 13(1)(c) related to data provided by members or created
9
as a result of their use of the LinkedIn platform. On the other hand, the personal data under consideration
in respect of Article 14(1)(c) comprised what LinkedIn defined as third party data (i.e. data provided to
LinkedIn by its enterprise customers) as well as data obtained from Bing.
In order to comply with Articles 13(1)(c) and 14(1)(c), a data controller must provide the following
information, and in the following way: (a) the purpose(s) of the specified processing operation/set of
processing operations for which the specified category/specified categories of personal data are intended,
and (b) the lawful basis being relied upon to support the processing operation/set of operations. This
information should be provided in such a way that there is a clear link from: (a) a specified
category/specified categories of personal data, to (b) the purpose(s) of the specified processing
operation/set of operations, and to (c) the lawful basis being relied upon to support that processing
operation/set of operations.
In light of this, and with regard to LinkedIn’s privacy policy and other disclosures regarding the relevant
processing activities, the DPC examined each lawful basis relied on by LinkedIn individually to assess
whether the information provided to users met the requirements of Articles 13(1)(c) and 14(1)(c). In each
instance, the DPC found that the required standard was not met. The reasons for those findings are briefly
summarised below.
With regard to the consent lawful basis, the DPC noted that only generalised reference to consent-based
processing were contained in LinkedIn’s privacy policy, informing data subjects that LinkedIn would rely
on this lawful basis and that they may withdraw or decline to give consent. The DPC acknowledged that a
layered approach to privacy disclosures was appropriate and had further regard to information provided
by LinkedIn by way of its consent mechanism, its help centre, and settings pages. However, as detailed
further above, the DPC concluded that the descriptions of LinkedIn’s partners in the relevant disclosures,
from whom it obtains personal data, was vague and did not give meaningful information as to the role
played by advertising technologies or the specific partners involved. Furthermore, the language used was
not language which would be readily accessible to or easily understood by laypersons. The DPC also did
not consider that LinkedIn set out to users sufficiently clearly the processing activities in respect of which
it relied on the consent lawful basis, as distinct from the processing activities in respect of which it relied
on the legitimate interests lawful basis, such that data subjects were not enabled to easily determine the
consequences of the consent they were being asked to give. Accordingly, LinkedIn did not set out the
required information in a way that displayed a clear link between the categories of personal data being
processed, the purpose of the processing operations and the lawful basis being relied on.
With regard to the contractual necessity lawful basis, the DPC again noted that LinkedIn only made
generalised references to this lawful basis in its user disclosures. LinkedIn’s privacy policy simply referred
to reliance on this lawful basis, and noted that it would process first party data for targeted advertising,
while its user agreement stated that it would “use the information and data that you provide and that we
have about Members to make recommendations for connections, content and features that may be useful
10
to you”. The DPC considered that this information manifestly did not seek to establish a clear link between
the categories of data processed for specific purposes on the basis of this lawful basis. As a result, data
subjects were unable, as a very first step, to link the categories of personal data processed and the
purposes for which they were processed to the relevant lawful basis of contractual necessity.
With regard to the legitimate interest lawful basis, LinkedIn’s privacy policy once more referred to reliance
on this lawful basis in a general sense and contained separate reference to the use of first party data for
ad targeting. A hyperlink was also provided which set out the legitimate interests that LinkedIn may rely
on for processing. The DPC additionally considered information contained in the settings for first-party
advertising and processing for analytics as well as a hyperlinked webpage. However, as with the lawful
basis of consent and contractual necessity, LinkedIn did not sufficiently clearly set out all of the categories
of personal data which LinkedIn processed on the basis of its legitimate interests, the purposes of those
processing operations and the lawful basis being relied upon. The DPC also found that there was not a
sufficient link between these elements was shown. In addition, a generalised reference to the use of data
obtained by “affiliates, including Microsoft” was not sufficient to inform users that it processed data
obtained from users’ use of Bing and the information about which personal data was processed on the
basis of legitimate interests versus consent was not made clear.
Articles 13(1)(d) and 14(2)(b)
Article 13(1)(d) provides that, where data is collected from data subjects, and the processing is based on
point (f) of Article 6(1) GDPR, data controllers must provide information on “the legitimate interests
pursued by the controller or by a third party.” Article 14(2)(b) repeats the requirement of Article 13(1)(d)
in the context where information is received from third parties. The primary requirement in Articles
13(1)(d) and 14(2)(b) GDPR is to outline the legitimate interests pursued and the DPC concluded that
LinkedIn outlined in its Privacy Policy the interests upon which it sought to base its processing. In
particular, a hyperlink was provided in the privacy policy, which set out the interests upon which LinkedIn
would base its processing. The DPC therefore did not find any infringement of Articles 13(1)(d) or 14(2)(b)
GDPR.
Fairness
Article 5(1)(a) GDPR requires that personal data be “processed lawfully, fairly and in a transparent manner
in relation to the data subject (‘lawfulness, fairness and transparency’)”. As has been noted by the EDPB
(Guidelines 4/2019), fairness is a broad principle, which requires that any processing of personal data
must be fair towards the individual whose personal data are concerned, and avoid being unduly
detrimental, unexpected, misleading, or deceptive.
Following a detailed examination of the processing, the DPC concluded:
11
• Data subjects were not in a position to fully understand the uses that would be made of their
personal data if they did or did not consent to its processing and were consequently were not in
a position to determine the uses that would be made of their data, depending on whether they
provided consent. They would thus not be aware, for example, which data was processed subject
to consent or legitimate interests, and would consequently not know whether the right to object
or to withdraw consent was exercisable in respect of that data.
• The combination of the words “continue” and “accept” in the consent mechanism would
reasonably be considered to nudge a data subject into accepting in order to continue and the
information which LinkedIn provided in the consent interstitial was framed in such a manner as
to imply that users would not see “relevant jobs” if they did not consent, and did so in a way that
went beyond what its actual impact was in respect of users being shown relevant jobs.
Additionally, the exclusive references to ads “on LinkedIn” on the first layer of the consent
interstitial may have deceived data subjects as to the scope of the processing carried out on the
basis of their consent.
• Data subjects would not have expected that third party data or inferred data and Bing data was
processed on the basis of legitimate interests for the purposes of BA & TA.
• The wording in LinkedIn’s consent mechanism was misleading to data subjects about the
processing carried out in reliance on consent. In particular, it was insufficiently clear regarding the
processing purposes to which data subjects could be considered to have consented to if they
clicked “Accept & Continue”, having regard to the closeness between the various purposes for
which LinkedIn processed first and third party data and the consequent lack of clarity in the
consent mechanism relied on by LinkedIn.
As a result of the above factors, the DPC concluded that the processing conducted by LinkedIn was not
conducted in a fair manner and infringed the principle of fairness in Article 5(1)(a).
Summary of Findings
The Decision concluded that:
• LinkedIn could not validly rely on Article 6(1)(a) GDPR to process third party data of its members
for the purpose of BA & TA, excluding analytics, on the basis that the consent obtained by LinkedIn
was not freely given, sufficiently informed or specific, or unambiguous.
• LinkedIn could not validly rely on Article 6(1)(f) GDPR for its processing of first-party data personal
data of its members for BA and TA or third party data for analytics.
• LinkedIn could not validly rely on Article 6(1)(b) GDPR to process first party data of its members
for the purpose of BA & TA.
12
• LinkedIn infringed Article 13(1)(c) and 14(1)(c) in respect of the information it provided to data
subjects regarding its reliance on Article 6(1)(a), Article 6(1)(b) and Article 6(1)(f) as lawful bases.
• LinkedIn infringed the principle of fairness in Article 5(1)(a) GDPR.
Corrective Measures
Under Section 113(4)(a) of the 2018 Act, where the DPC adopts a decision (in accordance with Section
113(2)(b)), it must, in addition, make a decision as to whether a corrective power should be exercised in
respect of the controller or processor concerned and, if so, the corrective power to be exercised. Article
58(2) GDPR sets out the corrective powers that supervisory authorities may exercise in respect of non-
compliance by a controller or processor.
Having carefully considered the infringements identified in the Decision, the DPC decided to exercise
certain corrective powers in accordance with Section 115 of the 2018 Act and Article 58(2) GDPR. The
corrective powers that the DPC decided were appropriate to address the infringements in the particular
circumstances were:
- Issuing a reprimand to LinkedIn in respect of its infringements of the GDPR identified in the
Decision (i.e. Articles 5(1)(a), 6(1), 13(1)(c) and 14(1)(c) GDPR).
- Imposing an order to LinkedIn to bring its processing into compliance with the GDPR. This order
requires:
o firstly, that LinkedIn to bring its Privacy Policy into compliance with Articles 13(1)(c) and
14(1)(c) GDPR as regards information provided on data processed pursuant to Articles
6(1)(a), 6(1)(b) and 6(1)(f) GDPR, if those legal bases continue to be relied upon by
LinkedIn for the purposes of BA & TA and analytics;
o secondly, that LinkedIn to take the necessary action to bring its processing of personal
data for the purpose of BA & TA into compliance with Article 6(1) GDPR, in particular, to
take the necessary action to address the findings in the Decision that LinkedIn did not
validly rely in Articles 6(1)(a), 6(1)(b) and 6(1)(f) GDPR to carry out the identified
processing.
- Imposing three administrative fines totalling €310 million, which were effective, proportionate
and dissuasive, as follows:
o With regard to LinkedIn’s reliance on the lawful basis in Article 6(1)(a) GDPR, and in
respect of LinkedIn’s infringements of Articles 5(1)(a) and 6(1) GDPR for the processing of
third party data of its members for BA & TA without a valid lawful basis, a fine of €105
million.
o With regard to LinkedIn’s reliance on the lawful bases in Articles 6(1)(b) and 6(1)(f) GDPR,
and in respect of LinkedIn’s infringements of Articles 5(1)(a) and 6(1) GDPR for the
processing of first party data of its members for BA & TA and third party data for analytics
without a valid lawful basis, a fine of €110 million.
13
o In respect of LinkedIn’s infringements of Article 13(1)(c) GDPR and 14(1)(c) GDPR, a fine
of €95 million.
The DPC did not impose a separate fine for the infringement of the Article 5(1)(a) GDPR principle of
fairness in circumstances where the infringement was based on conduct that the DPC had already fully
taken into account in imposing separate administrative fines.
Prior to its adoption, the DPC submitted a draft of its decision to the Concerned Supervisory Authorities
in July 2024, as required under Article 60(3) of the GDPR. The Concerned Supervisory Authorities did not
raise any objections (for the purpose of Article 60(4) GDPR) to the draft decision.
14