The Irish Data Protection Authority (DPC) has fined LinkedIn €310 million after concluding that the social network's processing of personal data by its users does not comply with the European Union's General Data Protection Regulation (GDPR).

As expressed in a statement by DPC, the Irish entity began an investigation following a complaint initially filed with the Data Protection Authority of France. In addition to the fine of 310 million euros, the DPC has issued an order for LinkedIn to bring its processing of personal data into line with EU regulations.

In this context, the Irish authority concludes that LinkedIn's processing of personal data was not based on the consent of the social network's users for third parties to process their data to analyze their behavior and be recipients of targeted advertising.

“The consent obtained by LinkedIn was not freely given, sufficiently informed or specific, “ says the agency, adding that ‘the lawfulness of the processing is a fundamental aspect of data protection law and processing without an adequate legal basis constitutes a clear and serious breach of the data subject'sfundamental right to data protection.’

For its part, LinkedIn has indicated that, while it believes it has complied with the General Data Protection Regulation, it is working to ensure that its advertising practices are compliant with the European regulation before the CPD deadline.

This is the sixth significant fine issued for GDPR breaches. The largest was a €1.55 billion penalty imposed on Meta by the Irish DPC in 2023.

TikTok was also fined by the EU 

In 2023, European regulators placed upon TikTok a €345 million fine for failing to protect children's privacy. It was the first time the popular short video-sharing app was punished for breaching Europe's strict data privacy rules.

In this case, Ireland's Data Protection Commission said it was fining TikTok and reprimanding the platform for the violations dating back to the second half of 2020.

The Commission's investigation also found that the default settings posed a risk to children under 13 who had gained access to the platform despite being underage.

In addition, the Commission ruled that a 'family pairing' feature designed for parents to manage settings was not strict enough, allowing adults to turn on direct messaging for users aged 16 and 17 without their consent.

The post LinkedIn gets fined €310 million for breaching the EU - GDPR appeared first on Cross-Border Magazine.

Vinted will have to pay a fine of 2.3 million euros for allegedly violating several aspects of the European General Data Protection Regulation (GDPR). The fine follows complaints from several Europeans - Germany, France, Poland, and Spain, and one of the main issues is the practice of 'shadowbanning'. As a result, the Lithuanian regulator SDPI (State Data Protection Inspectorate), where Vinted is registered, has launched an investigation against the company.

According to FashionUnited, the investigation shows that Vinted "does not adequately respect users' right to be forgotten". Vinted members have been asked to provide specific arguments to remove their personal data. If these specifics are not given, Vinted rejects the request, which is not allowed.

Furthermore, SDPI considers that "the fashion platform is not sufficiently transparent about which personal data it uses." In this context, it stresses that the platform practices 'shadowbanning'. That is, Vinted members can be excluded from Vinted without being informed. This practice is applied when the rules of behavior are violated. In such a case, users can still post items for sale, but other users cannot see their ads. SDPI considers this method "illegal."

In response to these accusations, Vinted has explained to the aforementioned media outlet, "We would like to reassure our members that the issues referred to by the Lithuanian data protection authority are in no way related to the security of their accounts nor do they involve abuse or violation of their personal data."

What exactly is Shadowbanning, and why is Vinted accused of doing it? 

Shadow banning, also called stealth banning, hell banning, ghost banning, and comment ghosting, is the practice of blocking or partially blocking a user or the user's content from some areas of an online community in such a way that the ban is not readily apparent to the user, regardless of whether the action is taken by an individual or an algorithm. For example, shadow-banned comments posted to a blog or media website would be visible to the sender, but not to other site users.

This practice is precisely what the EU authorities have accessed Vinted of doing, implying that some users have been banned without them fully knowing this. To this, Vinted has officially responded with the following: 

"We take privacy and GDPR very seriously and have invested heavily in compliance and protection of our members, collaborating throughout this process with the VDAI. However, we have found no legal basis for this decision and believe it sets a new precedent that goes beyond the current wording of the law and industry best practices. We fundamentally disagree with this fine and will continue to appeal, as we have throughout this process," the company said.

"Regarding the VDAI's decision on shadowbanning processes, which we used in the past to keep our platform and our members safe, we would like to reiterate that we no longer use these processes. We regularly evaluate these measures and adjust them to align with technological advances and changing legal regulations," they reiterated.

The post Vinted fined 2.3 million euros for ‘shadowbanning’ + Vinted official response  appeared first on Cross-Border Magazine.

The EU General Data Protection Regulation (GDPR) replaces the Data Protection Directive 95/46/EC and was designed to harmonize data privacy laws across Europe, to protect and empower all EU citizens data privacy and to reshape the way organizations across the region approach data privacy. The aim is to enable information to be freely shared internally across borders for companies that operate across the EU, but at the same time aims to make it clearer and give more control to individuals as to what companies can do with the data they hold on you.

Many small marketplace traders need not be overly concerned about the implications of the GDPR. However, entrepreneurs still need to be aware of its reach. Comply if necessary, fines can get up to 4% of your (global) turnover. The full impact of the GDPR is only applicable for data controllers and/or processors, i.e. when organizations store information on your customers. If you purely trade on marketplaces and take payment through services such as PayPal, then the impact of the GDPR may be minimal. It’ll be down to the marketplace and payment provider to keep the customer’s data safe and secure. However, if you download customer data and store it on your local hard drive or on a web server then the GDPR definitely applies to you.

The same situation arises if you have your own website/ web shop. If it is a hosted service then you won’t be storing customer data yourself. Again, download your customer data and you need to take a lot more notice of the GDPR. Ultimately, organizations should familiarise themselves with the GDPR requirements which classify more identifiers as ‘personal data’. Under the GDPR even an IP address can be construed as a personal identifier.

If you’re unsure as to how to proceed, the Information Commissioners Office has a data protection self assessment survey to help you get ready for the GDPR. Find key changes of the GDPR here.

The post Will the General Data Protection Regulation apply to you? appeared first on Cross-Border Magazine.