LinkedIn Profile Visitor Data Dispute: Noyb Challenges Microsoft's Premium Data Access Model Under GDPR

A seemingly minor LinkedIn feature has sparked a significant legal battle that could reshape how tech companies handle user data access in Europe. Privacy advocacy group Noyb ('none of your business') has challenged Microsoft-owned LinkedIn's practice of withholding detailed profile visitor information from non-paying users, claiming the company's premium data access model violates fundamental GDPR rights.

The dispute centers on LinkedIn's profile viewer feature, which displays information about who has visited a user's profile. Premium LinkedIn users receive comprehensive visitor details including names, job titles, employers, and direct links to profiles, with data going back 365 days. Free users, however, only receive aggregated information like "12 people found you through the homepage" or generic details about visitors' job titles and companies.

When a free user attempts to click on these limited visitor details, they're redirected either to a premium signup page or search results for employees at the mentioned companies, effectively creating a paywall for access to one's own data.

The legal challenge began when an unnamed LinkedIn user exercised their GDPR Article 15 right to access their personal data. The user requested a copy of their profile visitor information, but LinkedIn rejected the request on the grounds that protecting that data took precedence over providing access.

"Selling data to its own users is a popular practice among companies," Noyb data protection lawyer Martin Baumann explained. "In reality, however, people have the right to receive their own data free of charge."

GDPR Article 15 clearly establishes data subjects' right to obtain a copy of all personal data concerning them that has been processed by a company. In this case, the profile visitor list would seemingly fall under this category, regardless of whether LinkedIn chooses to present it differently or restrict access to paying customers.

LinkedIn's response to the situation raised further concerns. A LinkedIn spokesperson claimed that "Not only is it incorrect that only Premium members can see who has viewed their profile, but we also satisfy GDPR Article 15 by disclosing the information at issue via our Privacy Policy." This statement appears demonstrably false, as evidenced by the clear difference in functionality between premium and free accounts.

Noyb acknowledges there's a legal gray area in how GDPR applies to premium service offerings, but maintains that the principles are clear.

"If any business processes a person's personal data, this information is generally covered by their right of access under the GDPR," Baumann stated. "It does not matter that the business would prefer to sell the data to the data subject or that it would be harmful for their business model if they would."

The only potential exception in Article 15 that might give LinkedIn an argument, according to Baumann, is the provision stating that a person's right to their data cannot adversely affect the rights and freedoms of others. LinkedIn could potentially argue that revealing visitor identities would compromise those visitors' privacy.

"Since LinkedIn does provide information about profile visits to paying Premium members, it cannot consider that disclosing the data would adversely affect the rights of the visitors whose data is disclosed," Baumann countered. "Otherwise, providing this information to Premium users would be unlawful too."

The core issue appears to be where the right to access personal data ends and a company's business model of monetizing that data begins. Baumann hopes this case will clarify that personal data accessible through paid services should also be accessible through free GDPR requests.

"We expect a clarification concerning the fact that personal data that can be accessed when a user pays for it is also covered by their right of access," Baumann explained.

This case extends beyond LinkedIn. Baumann noted similar situations in other industries, such as banks that provide account statements for a fee but resist providing them in response to GDPR requests.

The potential implications of this case are significant. If Noyb succeeds, it could force companies to rethink how they structure premium features based on data access. Companies might need to offer comprehensive data access to all users while potentially charging for enhanced presentation, analysis, or additional features that don't constitute withholding the underlying data itself.

The case also highlights a growing tension between business models and privacy rights in the digital age. As companies increasingly monetize user data, regulatory frameworks like GDPR establish important boundaries to ensure that individuals maintain control over their own information.

This dispute comes amid increasing regulatory scrutiny of tech companies' data practices. European data protection authorities imposed €1.2 billion in fines last year as data breaches and privacy violations continued to rise.

For users, the case underscores an important principle: the data generated by their activities on platforms like LinkedIn remains their personal information, regardless of how companies choose to package or monetize it. GDPR's right of access serves as a crucial tool for individuals to maintain visibility into and control over their digital footprint.

As this case progresses, it may provide much-needed clarity on how GDPR applies to tiered service models and could establish important precedents for data access rights in the digital marketplace.