The Supreme Court will hear an appeal by the Data Protection Commission (DPC) relating to certain preliminary matters arising in LinkedIn’s challenge to the imposition of a €310 million fine by the commission.
In October 2024, the DPC fined LinkedIn €310 million for breaches of European data protection legislation.
Microsoft-owned LinkedIn claims that the fine was a sanction that is “criminal or penal in nature” due to its magnitude. The company subsequently initiated High Court proceedings challenging this decision.
LinkedIn asked the High Court to quash the DPC’s decision of October 2023, which came on foot of a 2018 complaint originally made to the French data watchdog by a French non-profit organisation called La Quadrature du Net.
In a statement at the time of its decision, the DPC said LinkedIn had obtained the consent of its users for their personal data to be sent to third parties for generating targeted advertising. However, it found the consent was not “freely given, sufficiently informed or specific, or unambiguous”, as is required under the GDPR.
LinkedIn Ireland said the DPC initially proposed imposing administrative fines of between €430 million and €490 million. That figure was reduced following submissions from the company.
The social media group focused on professional networking claims the severity of the fine entitled it to a fair and public hearing before an independent and impartial tribunal and to the presumption of innocence, as provided for in the Charter of Fundamental Rights.
In a judgment handed down in April, the High Court determined several preliminary issues in the proceedings. The DPC has appealed to the Supreme Court on three of the issues decided on by the High Court. LinkedIn is also looking to bring a cross-appeal on another preliminary issue.
Granting permission for the appeal, a three-judge Supreme Court panel noted that parties to the dispute agree that the issues raised in the High Court determination are matters of general public importance, a prerequisite for any case heard by the Supreme Court.
“[The case] will likely affect the approach to other statutory appeals. The DPC is the lead supervisory authority for GDPR [General Data Protection Regulation] purposes in this respect. The complaint in this case was initiated by a French non-profit organisation,” the court said.
“The number of subscribers to LinkedIn runs to hundreds of millions and the number of persons affected by the GDPR infringement found by the DPC was very significant indeed. And, finally, the State had been permitted to participate in the hearing in the High Court precisely because of the significance of the issues involved.”
The panel also decided that the issues raised warranted a leapfrog appeal from the High Court.
In those High Court proceedings, LinkedIn alleges the DPC, in inflicting such a severe fine and other reprimand, was not exercising limited functions and powers of a judicial nature within the meaning of the Constitution.
The company claims various sections of the 2018 Data Protection Act related to the commission’s powers are contrary to the Constitution, the Charter of Fundamental Rights and the State’s obligations under the European Convention on Human Rights.