6 ms·

What a silly title. Obviously if a company acquires another company they will acquire the email contacts and accounts as well. And LinkedIn has the right to con

by cm2012 6y ago

What a silly title. Obviously if a company acquires another company they will acquire the email contacts and accounts as well. And LinkedIn has the right to connect accounts they own across their web properties. The rest of the article is bottom tier conspiracy theory that this is a stealthy way for LinkedIn to secretly sell all their PII. This is dumb for a variety of reasons: 1) Linkedin makes all their money selling people ads and recruiting messages, they lose this if they sell direct access to their users. 2) 500m emails sale value isn't worth jack shit to a company the size of LI/Microsoft (see point 1).

guitarbill 6y ago
The GDPR "obviously" doesn't allow this, and as the blog says, this is a developer in London.
- tssva 6y ago
  It is not obvious the GDPR doesn't allow this. Transfer of data during sale of a business is allowed under the GDPR. Notification of a change in controller is required but there is no opt-in requirement. If the deal is structured so that it is a transfer of shares there is no need to even notify because the controller is considers to be the same.
  - BlackFly 6y ago
    No, it seems pretty obvious. Each use case of processing of personal information must satisfy the GDPR necessary requirement or have a priori informed consent. During merger of Scribd into LinkenIn, they can argue that it is necessary to treat the databases as a single controller as a cost cutting measure. However, if they are going to treat Scribd as a separate severable entity, then it cannot be argued that it is necessary to process personal information into the Scribd databases which going forward will only process data in a manner not consented to. If Scribd is not able to distinguish at that point original users that have meaningfully consented to being processed by Scribd from LinkedIn users who have not meaningfully consented to being processed, then they have no meaningful consent at all and therefore no real lawful user data because not knowing if a user has meaningfully consented or not is equivalent to not having meaningful consent for that user. The most similar scenario is when GDPR took effect and many companies essentially had no meaningful consent for their userbase. During the grace period between GDPR taking effect and GDPR fines being enforceable, companies contacted their userbase to acquire consent and the diligent companies destroyed the user records of the users that did not contact them back since meaningful consent cannot be opt out. Of course, many companies were not diligent and held onto user records nevertheless and are waiting to see if they will have to pay the piper or not. This is easily distinct from change of a controller when the new controller will continue the business: consent to have data processed in a particular way was acquired. In this case the separated entity will process data in a manner which was not consented to. Unless Scribd is somehow going to try to convince recruiters to use their service to find users who are going to manicure CV like profiles, which is more or less what LinkedIn users consent to.
    - tssva 6y ago
      But at least at this point Scribd has announced that they intend to run Slideshare as a separate entity and the database will not be integrated with the Scribd database.
      - nottorp 6y ago
        But every Linkedin user was signed up to SlideShare automatically.
  - luckylion 6y ago
    You'd need to get opt-in for sharing the data from LinkedIn with SlideShare though, because the contract between LinkedIn and the user does not extend to SlideShare as a different entity. In my understanding: either they violated GDPR by sharing data with SlideShare, or they violate it by selling SlideShare to Scribd.
- yxhuvud 6y ago
  Does GDPR still apply to London though, or is that yet another victim of Brexit? But yeah, the rest of EU is clearly off limit.
  - isostatic 6y ago
    The GDPR was implemented in UK law by the Data Protection Act 2018 https://www.legislation.gov.uk/ukpga/2018/12/contents https://www.legislation.gov.uk/ukpga/2018/12/contents Which is still in force
oefrha 6y ago
Step 1: Mega Corp buys small company A most of its users don’t give a shit about. Step 2: Mega Corp shares all its user account info with small company A. Step 3: Mega Corp sells small company A to ethically questionable company B (yes, I find the entire business model of Scribd very questionable), along with user info of all its users. Now the vast majority of those users who never gave a shit about A nor B are on B’s spam list. Yes, the casual sales of user info may not mean jack shit to Mega Corp, but it does mean something to B, and users who are completely unrelated to A nor B have a right to be incensed. (Btw, I haven’t received this as a LinkedIn user, so can’t attest to the accuracy of TFA. Maybe they don’t even have the courtesy to notify non-EU users?)
- cm2012 6y ago
  There's some excellent points in your comment that are not served by the breathless conspiratorial tone of the parent article. It's also possible that LI didn't share extra info at all with Scribd. The author takes a huge leap and assumes that all 500m LI emails have been transferred to Scribd because he got an email he doesn't recall ever signing up for.
  - deleted 6y ago
    [deleted]
  - Legogris 6y ago
    Oh it's absolutely the case, from someone who: * Never deleted an email from archive * Don't recall ever registering on either ScribD or Slideshare * Got the same email as the author, which is the first from either Slideshare or ScribD * Could log in using my LinkedIn account and saw all my personal information from LinkedIn there
  - basejumping 6y ago
    I didn't even receive a LI email, checked my spam as well, yet I can login to slideshare and see my account with full name and profile scraped from my LI account. Great! By the way, my email is marked private on my linkedin account, but now it's on slideshare. So selling information you marked as private!
deleted 6y ago
[deleted]
klelatti 6y ago
The title and the article seem to me to be factually correct and raise legitimate concerns about the sharing of personal data with third parties in a way that is potentially illegal for a large subset of the users concerned. Whether this is financially significant the the parties involved is beside the point.
jll29 6y ago
> And LinkedIn has the right to connect accounts they own across their web properties. Your claim is not generally true: EU citizens are protected from data processing (of their personal data) without seeking prior consent by GDPR. And that is a-priori "opt in", not a-posteriori "opt out".
- matthewheath 6y ago
  Consent is just one basis of processing. There are others, such as "legitimate interest" or for the performance of a contract, for example.
  - user5994461 6y ago
    I downvoted because your statement is misleading. A contract has to be lawful to be valid. A contract could transfer users, assuming regulations are followed and users were acquired legitimately (both of which are debatable here). However a contract that requires to transfer users without notice nor consent is defacto null because it is not lawful. These are extremely serious considerations for the case at hands. Companies knew what they were doing, the acquisition and PII transfer is not merely accidental, that should be covered in the contract. Depending on the wording and the intent of the companies (and any public backslash that might ensue and bring things to light), either side might lawyer up and reconsider the contract, or a third party like a regulator might jump in (could fine the parties or void the acquisition).
    - razakel 6y ago
      >massive fines With GDPR that can be a maximum 4% of global turnover, so "massive" is a bit of an understatement.
      - isostatic 6y ago
        > In the 2019 fiscal year, LinkedIn brought in $6.8 billion worth of revenue $272m isn't small change for each infringement, and there's millions of them here [0] https://www.businessofapps.com/data/linkedin-statistics/ https://www.businessofapps.com/data/linkedin-statistics/
jacquesm 6y ago
You should have a look into what 'legal basis for processing' means. In this case it is very relevant.
m12k 6y ago
> Obviously if a company acquires another company they will acquire the email contacts and accounts as well. And LinkedIn has the right to connect accounts they own across their web properties. Let's assume this is true, and see where it can take us. Let's imagine every online company in the US takes turns buying another such company, consolidating the user accounts, then splitting off/re-selling the other company. Eventually anybody that had an account with any company would have an account with every company, and this would be perfectly legal despite no users ever having been asked if their personal information could be shared? I think this is the rub: "And LinkedIn has the right to connect accounts they own across their web properties" I cannot speak to US law, but that is not true of the GDPR - collection of personally identifiable information requires consent, and that consent must be given for a specific purpose. Use of that information outside of the initial purpose that was consented to requires the user to re-consent to the additional uses. So no, a company is not allowed to just transfer my PII to a different business unit that provides a different service without my consent (and optionally then sell off that business unit like they did in the linked post).
- cm2012 6y ago
  Even GDPR does not require fresh consent for every new product and service. You have to have to update the privacy policy, inform users you're doing so, and let them opt out if they want (no objection rule). Which is exactly what LI is doing here. Keep in mind LI is NOT using this as a scheme like you describe to sell 500m emails.
  - emn13 6y ago
    I don't believe there is such a no objection rule - or perhaps I'm looking at it from a different angle - can you be more specific? Products and services aren't the issue; it's how you use+process users' data. Many products and services don't materially affect that, so won't require additional consent (e.g. if you're a company that sends news-updates by email to users that opted in, I don't believe sending them other updates is a PII issue - course, it might be spam, and IANAL). Also, products and services you're explicitly contracted for are exempt anyhow (e.g. if the user is paying you to remind them to take their meds on time, you don't need additional GDPR consent to store and process their sensitive personal data to the extent necessary to fulfill that contract - though other laws almost certainly apply to medical data).

by cm2012 6y ago

guitarbill 6y ago

The GDPR "obviously" doesn't allow this, and as the blog says, this is a developer in London.

tssva 6y ago
It is not obvious the GDPR doesn't allow this. Transfer of data during sale of a business is allowed under the GDPR. Notification of a change in controller is required but there is no opt-in requirement. If the deal is structured so that it is a transfer of shares there is no need to even notify because the controller is considers to be the same.
- BlackFly 6y ago
  No, it seems pretty obvious. Each use case of processing of personal information must satisfy the GDPR necessary requirement or have a priori informed consent. During merger of Scribd into LinkenIn, they can argue that it is necessary to treat the databases as a single controller as a cost cutting measure. However, if they are going to treat Scribd as a separate severable entity, then it cannot be argued that it is necessary to process personal information into the Scribd databases which going forward will only process data in a manner not consented to. If Scribd is not able to distinguish at that point original users that have meaningfully consented to being processed by Scribd from LinkedIn users who have not meaningfully consented to being processed, then they have no meaningful consent at all and therefore no real lawful user data because not knowing if a user has meaningfully consented or not is equivalent to not having meaningful consent for that user. The most similar scenario is when GDPR took effect and many companies essentially had no meaningful consent for their userbase. During the grace period between GDPR taking effect and GDPR fines being enforceable, companies contacted their userbase to acquire consent and the diligent companies destroyed the user records of the users that did not contact them back since meaningful consent cannot be opt out. Of course, many companies were not diligent and held onto user records nevertheless and are waiting to see if they will have to pay the piper or not. This is easily distinct from change of a controller when the new controller will continue the business: consent to have data processed in a particular way was acquired. In this case the separated entity will process data in a manner which was not consented to. Unless Scribd is somehow going to try to convince recruiters to use their service to find users who are going to manicure CV like profiles, which is more or less what LinkedIn users consent to.
  - tssva 6y ago
    But at least at this point Scribd has announced that they intend to run Slideshare as a separate entity and the database will not be integrated with the Scribd database.
    - nottorp 6y ago
      But every Linkedin user was signed up to SlideShare automatically.
- luckylion 6y ago
  You'd need to get opt-in for sharing the data from LinkedIn with SlideShare though, because the contract between LinkedIn and the user does not extend to SlideShare as a different entity. In my understanding: either they violated GDPR by sharing data with SlideShare, or they violate it by selling SlideShare to Scribd.
yxhuvud 6y ago
Does GDPR still apply to London though, or is that yet another victim of Brexit? But yeah, the rest of EU is clearly off limit.
- isostatic 6y ago
  The GDPR was implemented in UK law by the Data Protection Act 2018 https://www.legislation.gov.uk/ukpga/2018/12/contents https://www.legislation.gov.uk/ukpga/2018/12/contents Which is still in force

oefrha 6y ago

Step 1: Mega Corp buys small company A most of its users don’t give a shit about. Step 2: Mega Corp shares all its user account info with small company A. Step 3: Mega Corp sells small company A to ethically questionable company B (yes, I find the entire business model of Scribd very questionable), along with user info of all its users. Now the vast majority of those users who never gave a shit about A nor B are on B’s spam list. Yes, the casual sales of user info may not mean jack shit to Mega Corp, but it does mean something to B, and users who are completely unrelated to A nor B have a right to be incensed. (Btw, I haven’t received this as a LinkedIn user, so can’t attest to the accuracy of TFA. Maybe they don’t even have the courtesy to notify non-EU users?)

cm2012 6y ago
There's some excellent points in your comment that are not served by the breathless conspiratorial tone of the parent article. It's also possible that LI didn't share extra info at all with Scribd. The author takes a huge leap and assumes that all 500m LI emails have been transferred to Scribd because he got an email he doesn't recall ever signing up for.
- deleted 6y ago
  [deleted]
- Legogris 6y ago
  Oh it's absolutely the case, from someone who: * Never deleted an email from archive * Don't recall ever registering on either ScribD or Slideshare * Got the same email as the author, which is the first from either Slideshare or ScribD * Could log in using my LinkedIn account and saw all my personal information from LinkedIn there
- basejumping 6y ago
  I didn't even receive a LI email, checked my spam as well, yet I can login to slideshare and see my account with full name and profile scraped from my LI account. Great! By the way, my email is marked private on my linkedin account, but now it's on slideshare. So selling information you marked as private!

deleted 6y ago

[deleted]

klelatti 6y ago

The title and the article seem to me to be factually correct and raise legitimate concerns about the sharing of personal data with third parties in a way that is potentially illegal for a large subset of the users concerned. Whether this is financially significant the the parties involved is beside the point.

jll29 6y ago

> And LinkedIn has the right to connect accounts they own across their web properties. Your claim is not generally true: EU citizens are protected from data processing (of their personal data) without seeking prior consent by GDPR. And that is a-priori "opt in", not a-posteriori "opt out".

matthewheath 6y ago
Consent is just one basis of processing. There are others, such as "legitimate interest" or for the performance of a contract, for example.
- user5994461 6y ago
  I downvoted because your statement is misleading. A contract has to be lawful to be valid. A contract could transfer users, assuming regulations are followed and users were acquired legitimately (both of which are debatable here). However a contract that requires to transfer users without notice nor consent is defacto null because it is not lawful. These are extremely serious considerations for the case at hands. Companies knew what they were doing, the acquisition and PII transfer is not merely accidental, that should be covered in the contract. Depending on the wording and the intent of the companies (and any public backslash that might ensue and bring things to light), either side might lawyer up and reconsider the contract, or a third party like a regulator might jump in (could fine the parties or void the acquisition).
  - razakel 6y ago
    >massive fines With GDPR that can be a maximum 4% of global turnover, so "massive" is a bit of an understatement.
    - isostatic 6y ago
      > In the 2019 fiscal year, LinkedIn brought in $6.8 billion worth of revenue $272m isn't small change for each infringement, and there's millions of them here [0] https://www.businessofapps.com/data/linkedin-statistics/ https://www.businessofapps.com/data/linkedin-statistics/

jacquesm 6y ago

You should have a look into what 'legal basis for processing' means. In this case it is very relevant.

m12k 6y ago

> Obviously if a company acquires another company they will acquire the email contacts and accounts as well. And LinkedIn has the right to connect accounts they own across their web properties. Let's assume this is true, and see where it can take us. Let's imagine every online company in the US takes turns buying another such company, consolidating the user accounts, then splitting off/re-selling the other company. Eventually anybody that had an account with any company would have an account with every company, and this would be perfectly legal despite no users ever having been asked if their personal information could be shared? I think this is the rub: "And LinkedIn has the right to connect accounts they own across their web properties" I cannot speak to US law, but that is not true of the GDPR - collection of personally identifiable information requires consent, and that consent must be given for a specific purpose. Use of that information outside of the initial purpose that was consented to requires the user to re-consent to the additional uses. So no, a company is not allowed to just transfer my PII to a different business unit that provides a different service without my consent (and optionally then sell off that business unit like they did in the linked post).

cm2012 6y ago
Even GDPR does not require fresh consent for every new product and service. You have to have to update the privacy policy, inform users you're doing so, and let them opt out if they want (no objection rule). Which is exactly what LI is doing here. Keep in mind LI is NOT using this as a scheme like you describe to sell 500m emails.
- emn13 6y ago
  I don't believe there is such a no objection rule - or perhaps I'm looking at it from a different angle - can you be more specific? Products and services aren't the issue; it's how you use+process users' data. Many products and services don't materially affect that, so won't require additional consent (e.g. if you're a company that sends news-updates by email to users that opted in, I don't believe sending them other updates is a PII issue - course, it might be spam, and IANAL). Also, products and services you're explicitly contracted for are exempt anyhow (e.g. if the user is paying you to remind them to take their meds on time, you don't need additional GDPR consent to store and process their sensitive personal data to the extent necessary to fulfill that contract - though other laws almost certainly apply to medical data).