Irish Data Protection Commission fines LinkedIn Ireland €310 million

On October 24, 2024, the Irish Data Protection Commission (DPC) published a Press Release to announce its final decision following an inquiry into LinkedIn Ireland Unlimited Company (LinkedIn) (decision to be published soon).

The case originated from a complaint filed in August 2018 by French digital rights organization La Quadrature du Net which challenged the use of pre-ticked boxes, or clauses stipulating that continued use of the service constitutes acceptance and called for “a ban on behavioral analysis and advertising targeting” as well as “the highest possible” administrative fine”.

The French data protection authority (CNIL) referred the case to Ireland, where LinkedIn’s European headquarters are located.

According to the DPC, LinkedIn failed to meet required standards when obtaining valid consents from users. In addition to the fine of €310 million, LinkedIn received a formal reprimand and is required to ensure full compliance with GDPR regulations.

LinkedIn “believes it has complied with the GDPR” but assures that the company is “working to ensure (its) advertising practices comply” with the Irish regulator's ruling.

La Quadrature du Net “welcomes this decision, which is yet another reminder of the harmfulness of the Gafam (Google, Apple, Facebook, Amazon, Microsoft, editor's note) business model, and the importance of protecting personal data”,

“The lawfulness of processing is a fundamental aspect of data protection law, and the processing of personal data without an appropriate legal basis is a clear and serious violation of a data subject’s fundamental right to data protection,” Deputy Commissioner Graham Doyle commented.

Regulators around the world, particularly the EU, have been trying for years to regulate the tech giants in terms of unfair competition or data protection. In particular, they are regularly challenged in the EU for processing personal data contrary to GDPR. Last year, the US consumer protection agency (FTC) forced Microsoft to pay $20 million to end lawsuits for harvesting personal data from minors registered on the Xbox console's online gaming platform, without informing their parents. The company was also fined 60 million euros by the CNIL in 2022 for failing to allow easy refusal of cookies on its Bing search engine.

More information on https://www.dataprotection.ie/en/news-media/press-releases/irish-data-protection-commission-fines-linkedin-ireland-eu310-million