Third Party Response

When you are accessing data of a data subject on LinkedIn, you are processing that individual’s personal data, and according to article 6 – Lawfulness of processing – you need at least one legal ground for processing: consent, contractual obligation, legal obligation, vital interest, public interest, legitimate interest. If that person is contacted using LinkedIn platform’s features, such as Add Connection, InMail, Messaging, you don’t need data subject’s consent for processing, as that person already accepted LinkedIn’s Terms and Conditions, which allow that person to be contacted (if he/she didn’t modify the privacy preferences in the account). However, if you download/archive a person’s data from LinkedIn, you need another legal ground for the processing. It can be consent, but you need to obtain that person’s consent BEFORE you download/archive his/her data from LinkedIn.

Please also consult these resources:

• Four main questions for obtaining and managing data subjects’ consent under GDPR: https://advisera.com/articles/four-main-questions-for-obtaining-and-managing-data-subjects-consent-under-gdpr/
• Data Subject Consent Form: https://advisera.com/toolkit-documents/eu-gdpr/data-subject-consent-form/
• Is consent needed? Six legal bases to process data according to GDPR https://advisera.com/articles/is-consent-needed-six-legal-bases-to-process-data-according-to-gdpr/
• Article 6 GDPR – Lawfulness of processing: https://advisera.com/gdpr/lawfulness-of-processing/
• Article 7 GDPR  – Conditions for consent: https://advisera.com/gdpr/conditions-for-consent/