LinkedIn fined $335 million by Irish data regulator over targeted advertising

The Irish Data Protection Commission has fined Microsoft-owned LinkedIn a €310 million fine after it was concluded that the site illegally processed users' personal information to send them targeted ads. The regulator said the practice breached strict European Union data protection laws.

In a statement, the DPC's Deputy Commissioner Graham Doyle said the LinkedIn's processing of personal data without lawful basis constituted a "clear and serious infringement" of EU citizens' privacy rights. The case flows from a complaint filed in 2018 with regulators in France over LinkedIn's digital advertising activities in Europe.

The lawfulness of processing is a fundamental aspect of data protection law and the processing of personal data without an appropriate legal basis is a clear and serious violation of a data subjects’ fundamental right to data protection.

Under the EU's General Data Protection Regulation, or GDPR, which came into force in 2018, companies have to be transparent about how they're processing people's personal info and obtain properly informed consent from users. The DPC opened its probe after the complaint queried whether LinkedIn had a lawful basis for processing the personal data of EU members for targeted advertising.

Now, it seems the Irish regulator has ordered LinkedIn to implement changes going forward to comply with GDPR rules. LinkedIn said in a statement it believes it was acting in accordance with GDPR but it will work to ensure its practices meet the DPC's requirements by the imposed deadline.

Today the Irish Data Protection Commission (IDPC) reached a final decision on claims from 2018 about some of our digital advertising efforts in the EU. While we believe we have been in compliance with the General Data Protection Regulation (GDPR), we are working to ensure our ad practices meet this decision by the IDPC's deadline.

It is worth noting that Irish privacy watchdogs have taken jurisdiction to enforce LinkedIn's compliance with European data rules because the company is headquartered in Ireland.