LinkedIn Ireland Unlimited Company

Summary of Findings The Decision concluded that: LinkedIn could not validly rely on Article 6(1)(a) GDPR to process third party data of its members for the purpose of BA & TA, excluding analytics, on the basis that the consent obtained by LinkedIn was not freely given, sufficiently informed or specific, or unambiguous. LinkedIn could not validly rely on Article 6(1)(f) GDPR for its processing of first-party data personal data of its members for BA and TA or third party data for analytics. LinkedIn could not validly rely on Article 6(1)(b) GDPR to process first party data of its members for the purpose of BA & TA. LinkedIn infringed Article 13(1)(c) and 14(1)(c) in respect of the information it provided to data subjects regarding its reliance on Article 6(1)(a), Article 6(1)(b) and Article 6(1)(f) as lawful bases. LinkedIn infringed the principle of fairness in Article 5(1)(a) GDPR. Corrective Measures Under Section 113(4)(a) of the 2018 Act, where the DPC adopts a decision (in accordance with Section 113(2)(b)), it must, in addition, make a decision as to whether a corrective power should be exercised in respect of the controller or processor concerned and, if so, the corrective power to be exercised. Article 58(2) GDPR sets out the corrective powers that supervisory authorities may exercise in respect of non- compliance by a controller or processor. Having carefully considered the infringements identified in the Decision, the DPC decided to exercise certain corrective powers in accordance with Section 115 of the 2018 Act and Article 58(2) GDPR.