December 12, 2022
Table of Contents
- LinkedIn Data Processing Agreement (DPA)
- Schedule A: Description of the Transfer
- Schedule B: CCPA Addendum
- Schedule C: Glint Specific Terms and Amendments
- Schedule D: Technical and Organisational Measures Including Technical and Organisational Measures to Ensure the Security of the Data
This Data Processing Agreement (the “DPA”), entered into by the LinkedIn customer identified on the applicable LinkedIn ordering document for LinkedIn services (“Customer”) and the LinkedIn company identified on the ordering document (along with its affiliates, “LinkedIn”), governs the processing of Personal Data that Customer uploads or otherwise provides LinkedIn in connection with the services, the processing of Personal Data by LinkedIn on behalf of Customer in connection with the services, and the processing of any Personal Data that LinkedIn uploads or otherwise provides to Customer in connection with the services. Terms specific to LinkedIn’s Glint services are provided as Schedule C to this DPA.
This DPA is incorporated into the relevant LinkedIn services agreement attached to or incorporated by reference into the ordering document previously executed by Customer, referred to generically in this DPA as the “LinkedIn Contract”. Collectively, the DPA (including the SCCs, as defined herein), the LinkedIn Contract, and the applicable ordering documents are referred to in this DPA as the “Agreement”. In the event of any conflict or inconsistency between any of the terms of the Agreement, the provisions of the following documents (in order of precedence) shall prevail: (a) the SCCs; (b) the applicable ordering document to the LinkedIn Contract; (c) this DPA; (d) the LinkedIn Contract. Except as specifically amended in this DPA, the LinkedIn Contract and applicable ordering document remain unchanged and in full force and effect.
“CCPA” means the California Consumer Privacy Act of 2018 together, as amended by the California Privacy Rights Act of 2020, with any subordinate legislation or regulations.
“Customer Personal Data” means Personal Data that Customer uploads or otherwise provides LinkedIn in connection with its use of LinkedIn’s services.
“Data Protection Requirements” means the General Data Protection Regulation, and any applicable laws, regulations, and other legal requirements relating to (a) privacy, data security, and protection of Personal Data; and (b) the Processing of any Personal Data. Data Protection Requirements may include, but are not limited to, UK GDPR, the Swiss Federal Act on Data Protection 2020, Lei Geral de Proteção de Dados (Brazil’s General Data Protection Law), the CCPA, the Colorado Privacy Act, the Connecticut Data Privacy Act, the Utah Consumer Privacy Act, and the Virginia Consumer Data Protection Act.
“EU Personal Data” means Personal Data the sharing of which pursuant to this Agreement is regulated by the General Data Protection Regulation.
“General Data Protection Regulation” or "GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council together with any subordinate legislation or regulation implementing the General Data Protection Regulation.
“Personal Data” means information about an individual that (a) can be used to identify, contact or locate a specific individual; (b) can be combined with other information that can be used to identify, contact or locate a specific individual; or (c) is defined as “personal data” or “personal information” by applicable laws or regulations relating to the collection, use, storage or disclosure of information about an identifiable individual.
“Personal Data Breach” means any accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data.
“Process” and its cognates mean any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
“SCCs” means the European Commission Standard Contractual Clauses entered into between the parties under the Agreement.
“Subprocessor” means any entity which provides processing services to LinkedIn in furtherance of LinkedIn’s processing of Customer Personal Data.
“Supervisory Authority” means an independent public authority which is (i) established by a European Union member state pursuant to Article 51 of the General Data Protection Regulation; or (ii) the public authority governing data protection, which has supervisory authority and jurisdiction over Customer
"UK GDPR" means the UK General Data Protection Regulation, amended by the Data Protection Act 2018.
"UK Personal Data" means Personal Data the sharing of which pursuant to this Agreement is regulated by the UK GDPR.
2. NATURE OF DATA PROCESSING
Each party agrees to Process Personal Data received under the Agreement only for the purposes set forth in the Agreement. For the avoidance of doubt, the categories of Personal Data Processed and the categories of data subjects subject to this DPA are described in Schedule A to this DPA.
3. COMPLIANCE WITH LAWS
The parties shall each comply with their respective obligations under all applicable Data Protection Requirements.
4. CUSTOMER OBLIGATIONS
4.1 Customer agrees to: (i) determine the purposes and general means of LinkedIn’s Processing of Customer Personal Data in accordance with the Agreement; and (ii) comply with its protection, security and other obligations with respect to Customer Personal Data prescribed by Data Protection Requirements for data controllers.
4.2Customer agrees to, at LinkedIn's request, designate to LinkedIn a single point of contact (the “Master Admin”) responsible for (i) receiving and responding to data subject requests LinkedIn receives from Customer data subjects relating to Customer Personal Data; and (ii) notifying LinkedIn of Customer’s intended response to a data subject request relating to the access to or the rectification, erasure, restriction, portability, blocking or deletion of Customer Personal Data that LinkedIn processes for Customer, and authorizing LinkedIn to fulfill such responses on behalf of Customer.
5. LINKEDIN OBLIGATIONS
5.1 Processing Requirements. LinkedIn will:
a. Process Customer Personal Data (i) only for the purpose of providing, supporting and improving LinkedIn’s services (including to provide insights and other reporting), using appropriate technical and organizational security measures; and (ii) in compliance with the instructions received from Customer. LinkedIn will not use or Process the Customer Personal Data for any other purpose. LinkedIn will promptly inform Customer in writing if it cannot comply with the requirements under Sections 5-8 of this DPA, in which case Customer may terminate the Agreement or take any other reasonable action, including suspending data processing operations;
b. Inform Customer promptly if, in LinkedIn’s opinion, an instruction from Customer violates applicable Data Protection Requirements;
c. If LinkedIn is collecting Customer Personal Data from individuals on behalf of Customer, follow Customer’s instructions regarding such Customer Personal Data collection (including with regard to the provision of notice and exercise of choice);
d. Take steps to ensure that (i) persons employed by it and (ii) other persons engaged to perform on LinkedIn’s behalf comply with the terms of the Agreement;
e. Ensure that its employees, authorized agents and any Subprocessors are required to comply with and acknowledge and respect the confidentiality of the Customer Personal Data, including after the end of their respective employment, contract or assignment;
f. If it intends to engage Subprocessors to help it satisfy its obligations in accordance with this DPA or to delegate all or part of the processing activities to such Subprocessors, (i) exclusive of the list of Subprocessors LinkedIn and its Affiliates maintains online (currently available at https://legal.linkedin.com/customer-subprocessors), the use of which Customer approves, obtain the prior written consent of Customer to such subprocessing, such consent to not be unreasonably withheld; (ii) remain liable to Customer for the Subprocessors’ acts and omissions with regard to data protection where such Subprocessors act on LinkedIn’s instructions; and (iii) enter into contractual arrangements with such Subprocessors binding them to provide the same level of data protection and information security to that provided for herein; and
g. Upon request, provide Customer with a mapping of LinkedIn's security policies to the controls set forth in the International Organization for Standardization (ISO) / International Electrotechnical Commission (IEC) 27001 standard.
5.2 Notice to Customer. LinkedIn will inform Customer if LinkedIn becomes aware of:
a. Any non-compliance by LinkedIn or its employees with Sections 5-8 of this DPA or the Data Protection Requirements relating to the protection of Customer Personal Data Processed under this DPA;
b. Any legally binding request for disclosure of Customer Personal Data by a law enforcement authority, unless LinkedIn is otherwise forbidden by law to inform Customer, for example to preserve the confidentiality of an investigation by law enforcement authorities;
c. Any notice, inquiry or investigation by a Supervisory Authority with respect to Customer Personal Data; or
d. Any complaint or request (in particular, requests for access, rectification, erasure, restriction, portability, blocking or deletion of Customer Personal Data) received directly from data subjects of Customer. LinkedIn will not substantively respond to any such request without Customer’s prior written authorization.
5.3 Assistance to Customer. LinkedIn will provide reasonable assistance to Customer regarding:
a. Any requests from Customer data subjects in respect of access to or the rectification, erasure, restriction, portability, blocking or deletion of Customer Personal Data that LinkedIn Processes for Customer. In the event that a data subject sends such a request directly to LinkedIn, LinkedIn will promptly send such request to Customer;
b. The investigation of Personal Data Breaches and the notification to the Supervisory Authority and Customer's data subjects regarding such Personal Data Breaches; and
c. Where appropriate, the preparation of data protection impact assessments and, where necessary, carrying out consultations with any Supervisory Authority.
5.4 Required Processing. If LinkedIn is required by Data Protection Requirements to Process any Customer Personal Data for a reason other than providing the services described in the Agreement, LinkedIn will inform Customer of this requirement in advance of any Processing, unless LinkedIn is legally prohibited from informing Customer of such Processing (e.g., as a result of secrecy requirements that may exist under applicable EU member state laws).
5.5 Security. LinkedIn will:
a. Maintain appropriate organizational and technical security measures (which may include, with respect to personnel, facilities, hardware and software, storage and networks, access controls, monitoring and logging, vulnerability and breach detection, incident response, encryption of Customer Personal Data while in transit and at rest) designed to protect against unauthorized or accidental access, loss, alteration, disclosure or destruction of Customer Personal Data, including the security measures set forth in Schedule D to this DPA, which shall apply as Annex II of the SCCs;
b. Be responsible for the sufficiency of the security, privacy, and confidentiality safeguards of all LinkedIn personnel with respect to Customer Personal Data and liable for any failure by such LinkedIn personnel to meet the terms of this DPA;
c. Take reasonable steps to confirm that all LinkedIn personnel are protecting the security, privacy and confidentiality of Customer Personal Data consistent with the requirements of this DPA, which shall apply as Annex II of the SCCs; and
d. Notify Customer of any Personal Data Breach by LinkedIn, its Subprocessors, or any other third parties acting on LinkedIn’s behalf without undue delay and in any event within 48 hours of becoming aware of a Personal Data Breach.
e. If a Personal Data Breach results from either (i) the negligence or intentional misconduct of LinkedIn (or any LinkedIn Subprocessor consistent with Section 5.1(f)) or (ii) a material failure of LinkedIn to comply with the terms of this DPA, LinkedIn shall bear all costs associated with investigating and remediating the Personal Data Breach. LinkedIn shall provide reasonable reimbursement to Customer for any costs associated with notifying affected individuals as required by law or providing individuals with credit monitoring or other appropriate remediation services, provided that LinkedIn, as a processor, will adhere to its commitments under 5.3(b) of this DPA.
6. AUDIT, CERTIFICATION
6.1 Supervisory Authority Audit of Customer. If a Supervisory Authority requires an audit of the data processing facilities from which LinkedIn Processes Customer Personal Data in order to ascertain or monitor Customer's compliance with Data Protection Requirements, LinkedIn will cooperate with such audit. Customer is responsible for all costs and fees related to such audit, including all reasonable costs and fees for any and all time LinkedIn expends for any such audit, in addition to the rates for services performed by LinkedIn.
6.2Audits. Upon request, LinkedIn will provide to Customer each year an opinion or Service Organization Control report provided by an accredited, third-party audit firm under the Statement on Standards for Attestation Engagements (SSAE) No. 18 (“SSAE 18”) (Reporting on Controls at a Service Organization) or the International Standard on Assurance Engagements (ISAE) 3402 (“ISAE 3402”) (Assurance Reports on Controls at a Service Organization) standards applicable to the services under the Agreement (each such report, a “Report”). If a Report does not provide, in Customer’s reasonable judgment, sufficient information to confirm LinkedIn’s compliance with the terms of this DPA, then Customer or an accredited third-party audit firm agreed to by both Customer and LinkedIn may audit LinkedIn’s compliance with the terms of this DPA during regular business hours, with reasonable advance notice to LinkedIn and subject to reasonable confidentiality procedures. Customer is responsible for all costs and fees related to such audit, including all reasonable costs and fees for any and all time LinkedIn expends for any such audit, in addition to the rates for services performed by LinkedIn.Before the commencement of any such audit, Customer and LinkedIn shall mutually agree upon the scope, timing, and duration of the audit. Customer shall promptly notify LinkedIn with information regarding any non-compliance discovered during the course of an audit. Customer may not audit LinkedIn more than once annually.
7. DATA TRANSFERS
7.1 For transfers of EU Personal Data to LinkedIn for processing by LinkedIn in a jurisdiction other than a jurisdiction in the EU, the EEA, or the European Commission-approved countries providing ‘adequate’ data protection, each party agrees it will use Module 2 of the SCCs for Controller to Processor transfers, which are incorporated herein by reference. The parties agree that the following terms apply: (i) the Data Protection Commission of Ireland shall be the competent Supervisory Authority pursuant to Clause 13 of the SCCs; (ii) data subjects for whom a LinkedIn entity processes EU Personal Data are third-party beneficiaries under the applicable SCCs; (iii) the SCCs shall be governed by the law of Ireland, which allows for third-party beneficiary rights pursuant to Clause 17 of the SCCs; and (iv) any dispute arising from the SCCs shall be resolved by the courts of Ireland pursuant to Clause 18 of the SCCs. Schedule A to this DPA shall apply asAnnex I of SCCs and Schedule D shall apply at Annex II of the SCCs.
7.2 If LinkedIn is unable or becomes unable to comply with these requirements, then EU Personal Data will be processed and used exclusively within the territory of a member state of the European Union and any movement of EU Personal Data to a non-EU country requires the prior written consent of Customer. LinkedIn shall promptly notify Customer of any inability by LinkedIn to comply with the provisions of this Section 7. Notwithstanding the foregoing, where the transfers contemplated under this Section 7 result in transfers of UK Personal Data to LinkedIn for processing by LinkedIn in a jurisdiction other than in the UK or UK Information Commissioner’s Office-approved countries providing ‘adequate’ data protection, (1) each party agrees it will use the 2010 Controller-to-Processor SCCs for so long as such SCCs are lawfully permitted for such transfers of UK Personal Data, and (2) Schedules A and D shall apply as Annex I and Annex II, respectively. In the event that the UK Information Commissioner’s Office confirms that a “UK Addendum to the EU Standard Contractual Clauses” (“UK Addendum”) is required to rely lawfully on the SCCs for transfers of UK Personal Data, then (a) the SCCs used for EU Personal Data shall also apply to transfers of UK Personal Data; (b) the UK Addendum shall be deemed executed between Customer and LinkedIn; and (c) the SCCs between the parties shall be deemed amended as specified in the UK Addendum in respect of the transfer of such UK Personal Data. The UK Information Commissioner is the exclusive Supervisory Authority for the transfers of UK Personal Data under this Agreement.
8. DATA RETURN AND DELETION
The parties agree that on the termination of the data processing services or upon Customer’s reasonable request, LinkedIn shall, and shall cause any Subprocessors to, at the choice of Customer, return all the Customer Personal Data and copies of such data to Customer or securely destroy them and demonstrate to the satisfaction of Customer that it has taken such measures, unless Data Protection Requirements prevent LinkedIn from returning or destroying all or part of the Customer Personal Data disclosed. In such case, LinkedIn agrees to preserve the confidentiality of the Customer Personal Data retained by it and that it will only actively Process such Customer Personal Data after such date in order to comply with applicable laws. For clarity, LinkedIn may continue to Process Customer Personal Data that has been aggregated in a manner that does not identify individuals or customers to improve LinkedIn’s systems and services.
9. CONTROLLER-TO-CONTROLLER SCENARIOS
Certain Services may offer integrated viewing and export of Personal Data of LinkedIn members that Customer already may access on LinkedIn’s website, LinkedIn.com, consistent with member privacy settings. For purposes of GDPR, where there is a member-directed export of Personal Data or where Customer already may access such Personal Data, both Customer and LinkedIn will be independent controllers of Personal Data originally derived on the LinkedIn Services.The parties agree that, for such cases, LinkedIn and Customer would each act as a data controller with respect to their particular copy of the Personal Data. Each party will, to the extent that it, along with the other party, acts as data controller, as the term is defined in applicable Data Protection Requirements, with respect to Personal Data, reasonably cooperate with the other party to enable the exercise of data protection rights as set forth in the Data Protection Requirements. Where both parties each act as data controller with respect to Personal Data, and the transfer of data between the parties results in a transfer of EU Personal Data to a jurisdiction other than a jurisdiction in the EU, the EEA, or the European Commission-approved countries providing ‘adequate’ data protection, each party agrees it will use Module 1 of the SCCs, which are incorporated herein by reference. The parties agree that the following terms apply: (i) the Data Protection Commission of Ireland shall be the competent Supervisory Authority pursuant to Clause 13 of the SCCs; (ii) data subjects for whom a LinkedIn entity processes EU Personal Data are third-party beneficiaries under the applicable SCCs; (iii) the SCCs shall be governed by the law of Ireland, which allows for third-party beneficiary rights pursuant to Clause 17 of the SCCs; and (iv) any dispute arising from the SCCs shall be resolved by the courts of Ireland pursuant to Clause 18 of the SCCs. Notwithstanding the foregoing, where the transfers contemplated under this Section 9 results in a transfer of UK Personal Data to a jurisdiction other than in the UK or UK Information Commissioner’s Office-approved countries providing ‘adequate’ data protection, (1) the 2004 Controller-to-Controller SCCs, which are incorporated herein by reference, will apply for so long as such SCCs are lawfully permitted for such transfers of UK Personal Data, (2) Schedule A and Schedule D shall apply as Annex B and Annex II, respectively, and (3) for purpose of Section II(h), the data importer will process the UK Personal Data, at its option, in accordance with the data processing principles set out in Annex A of the Controller-to-Controller SCCs. In the event that the UK Information Commissioner’s Office confirms that a UK Addendum is required to rely lawfully on the SCCs contemplated under this Section 9 for transfers of UK Personal Data, then (a) SCCs used for EU Personal Data under this Section 9 shall also apply to transfers of UK Personal Data; (b) the UK Addendum shall be deemed executed between Customer and LinkedIn; and (c) the SCCs between the parties shall be deemed amended as specified in the UK Addendum in respect of the transfer of such UK Personal Data..
Unless otherwise agreed in writing, the parties acknowledge and agree that each is acting independently as Data Controller with respect of Personal Data and the parties are not joint controllers as defined in the General Data Protection Regulation and UK GDPR.
10. THIRD PARTY DATA PROCESSORS
Customer acknowledges that in the provision of some services (such as Applicant Tracking Systems, Learning Management Systems, and Customer Management Systems), LinkedIn, on receipt of instructions from Customer, may transfer Customer Personal Data to and otherwise interact with third party data processors. Customer agrees that if and to the extent such transfers occur, Customer is responsible for entering into separate contractual arrangements with such third-party data processors binding them to comply with obligations in accordance with Data Protection Requirements. For avoidance of doubt, such third-party data processors are not Subprocessors.
This DPA shall remain in effect as long as LinkedIn carries out Personal Data processing operations on behalf of Customer or until the termination of the LinkedIn Contract (and all Personal Data has been returned or deleted in accordance with Section 8 above).
12. GOVERNING LAW, JURISDICTION, AND VENUE
Notwithstanding anything in the Agreement to the contrary, this DPA shall be governed by the laws of Ireland, and any action or proceeding related to this DPA (including those arising from non-contractual disputes or claims) will be brought in Dublin, Ireland. However, where a dispute arises regarding the processing of UK Personal Data under this DPA, such dispute shall be governed by the laws of England and Wales.
ANNEX 1 - DESCRIPTION OF THE TRANSFER
Categories of data subjects whose Personal Data is transferred:
Module 1 (Controller to Controller): Registered users of LinkedIn.com (“LinkedInMembers”)
Module 2 (Controller to Processor):
Categories of Personal Data transferred:
Module 1 (Controller to Controller)
The data transferred is the Personal Data of LinkedInMembers that Customer already may access on LinkedIn’s website, LinkedIn.com, consistent with member privacy settings, provided by the data exporter (LinkedIn)to the data importer (Customer) in connection with Customer’s use of LinkedIn’s online recruiting, sales, and/or learning services, andsubsequentlyprocessed byCustomer for its own purposes. Such Personal Data may include first name, last name, email address, contact information, education, and work history.
Module 2 (Controller to Processor)
The data transferred is the Personal Data provided by the data exporter (Customer) to the data importer (LinkedIn) in connection with its use of LinkedIn’s online recruiting, sales, marketing, employee engagement, and/or learning services, referred to as Customer Personal Data in the Data Processing Agreement.
Such Customer Personal Data may include, depending on the Customer’s or Customer’s seat holder’s input/interaction
Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures:
If Yes, include a description of the applied restrictions or safeguards in place here:
The frequency of the transfers (e.g. whether the data is transferred on a one-off or continuous basis):
Nature of the processing
Collection, organization, structuring, use, storage, combination, making available on LinkedIn properties in accordance with the relevant services.
Purpose(s) of the data transfer and further processing:
- Provide, maintain and improve services (in accordance with the DPA) to the data exporter,
- Provide customer support to the data exporter,
- Otherwise fulfil LinkedIn’s (and, if applicable, its affiliate’s) obligations under its respective services agreement with the data exporter; and
- Compliance with applicable law.
The period for which the Personal Data will be retained, or, if that is not possible, the criteria used to determine that period:
LinkedIn will retain the data for the duration of the term of the services specified on the ordering document and in accordance with Section 8 of the DPA.
For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing:
LinkedIn uses sub-processors to support its infrastructure environment, local and international providers of telecommunications and networking services, legal entities engaged in data storage and content delivery material. Personal Data processed by sub-processors is processed for the purposes and duration of the relevant LinkedIn services agreement or ordering document. For more information, see LinkedIn’s List of Subprocessors located at the following web address: https://legal.linkedin.com/customer-subprocessors, which also shall apply as Annex III of the SCCs, where applicable.
For Hire, Learning, and Sales, the Personal Data of LinkedIn Members who are Customer’s users and who choose to connect their personal LinkedIn.com Member profile with the enterprise seat provided by the Customer is not included herein and is governed instead by the separate Standard Contractual Clauses between LinkedIn Ireland Unlimited Company as data exporter and LinkedIn Corporation as the data importer.
ADDENDUM TO LINKEDIN DATA PROCESSING AGREEMENT
California Consumer Privacy Act
This Addendum is entered into by the LinkedIn customer identified on the applicable LinkedIn ordering document for LinkedIn services (“Customer”) and the LinkedIn company identified on the ordering document (“LinkedIn”), and amends the LinkedIn Data Processing Agreement between Customer and LinkedIn (“DPA”) with respect to LinkedIn’s processing of Customer Personal Data of California Consumers under the CCPA. Capitalized terms used but not otherwise defined in this Addendum will have the meanings given to them in the DPA. Capitalized terms not otherwise defined in the DPA, will have the meanings given to them under the CCPA.
No CCPA Sale. The parties agree that for the purposes of the CCPA, LinkedIn acts as a CCPA Service Provider for Customer Personal Data. By executing the ordering document,
- Customer does not Sell Customer Personal Data to LinkedIn. LinkedIn shall only use Customer Personal Data for the purposes permitted by the CCPA and as specified in the Agreement. LinkedIn agrees not to Sell or Share (as defined by the CCPA) Customer Personal Data.
- LinkedIn agrees not to combine Customer Personal Data with other personal information except as permitted by the CCPA.
- To the extent LinkedIn receives information from Customer that has been deidentified, as defined under applicable Data Protection Requirements, LinkedIn agrees not to attempt to reidentify the data, to take reasonable measures to maintain and use the information in a deidentified manner, except as permitted by law, and to contractually obligate any authorized recipients to comply with applicable Data Protection Requirements for information that has been deidentified.
- LinkedIn agrees to inform Customer within the time period required under the CCPA, if LinkedIn determines that it is no longer able to meet its obligations under the CCPA.
- LinkedIn certifies that it has read and understands this Addendum and will abide by it, including by avoiding any action that would cause the other Party to be deemed to have Sold Personal Data or Personal Information under the CCPA.
GLINT-SPECIFIC TERMS AND AMENDMENTS
The following terms and conditions amend the DPA with respect to only those LinkedIn products and services offered under the Glint brand (including Glint Engage and Glint Perform). For avoidance of doubt, if Customer purchases Glint services as provided under the Agreement (“Glint Services”) in addition to LinkedIn-branded services, the following amendments apply only with respect to those Glint products or services and the DPA will apply unamended with respect to the LinkedIn-branded services.
The following clauses are added to the DPA as a new Section 4.3:
4.3 Notice and Choice.
a. Customer agrees to provide appropriate notices to its Customer Users of the Glint Servicesabout and, if required by Data Protection Requirements, obtain appropriate consent or other appropriate legal basis from such Customer Users for: (i) the collection, transfer and processing of Customer Personal Data through LinkedIn’s services and (ii) Customer’s use of any service providers or other third-parties that Customer instructs LinkedIn to send Customer Personal Data to or provide Customer Personal Data to LinkedIn. Without limiting the generality of the foregoing, Customer may provide LinkedIn with Personal Data for the purpose of enabling LinkedIn to provide the LinkedIn services. Customer represents and warrants that it has the necessary right and full power and authority to provide the Personal Data to LinkedIn.
b. Customer will decide the content of “User Confidentiality Notices” that will be provided to Customer Users (e.g., for Glint Engage, a survey Confidentiality Notice) relating to the degree of confidentiality and aggregation threshold that a Customer User will have and, if applicable, any required disclosures under any Data Protection Requirement (e.g., Art. 13 of the General Data Protection Regulation). At Customer’s option, Customer may use a default LinkedIn User Confidentiality Notice.Customer’s Master Admin will provide LinkedIn with the User Confidentiality Notice at least three (3) business days prior to use. Customer agrees that it will not modify or delete any portion of the User Confidentiality Notice or include any statements in any communication with a Customer User that imposes any obligation on LinkedIn or in any way modifies, contradicts, or supplements User Confidentiality Notice provided to LinkedIn. Customer is solely and exclusively responsible for ensuring that its use of Customer Personal Data and the User Confidentiality Notice complies with all applicable Data Protection Requirements.
The following clauses are added to the DPA as a new Section 4.4:
4.4 Aggregation and Non-Identification. To the extent a User Confidentiality Notice informs Customer Users that the Customer will only receive data from LinkedIn in an aggregated form, Customer agrees it will not receive, nor attempt to discern, any such Customer Personal Data in a form that identifies individual Customer Users with Customer Personal Data.
The first sentence of Section 5.1.a of the DPA is replaced with the following sentence:
Process Customer Personal Data (i) only for the purpose of providing, supporting and improving the Glint Services (including by providing aggregated, non-identifiable insights to improve the Glint Services and LinkedIn services, and providing survey benchmarking data to LinkedIn customers, where both the data subject and Customer have been de-identified), using appropriate technical and organizational security measures; and (ii) in compliance with the instructions received from Customer.
Section 5.1.g of the DPA is replaced in its entirety with the following clause:
Upon request, provide Customer with a summary of LinkedIn's security policies applicable to the Glint-branded services.
Section 8 of the DPA is replaced in its entirety with the following clauses:
The parties agree that on the termination of the data processing services, LinkedIn shall, and shall cause any Subprocessors to, at the choice of Customer, unless Data Protection Requirements prevent LinkedIn from returning or destroying all or part of the Customer Personal Data disclosed: (i) return to Customer all the Customer Personal Data, including survey responses if the Customer User Confidentiality Notice disclosed Customer would receive responses identified to individuals, or (ii) securely destroy them and demonstrate to the satisfaction of Customer that it has taken such measures or (iii) export Customer Personal Data in a non-aggregated form to Customer’s new service provider under a separate written agreement reasonably satisfactory to LinkedIn under which Customer and the recipient of the data accept responsibility and liability for the Customer Personal Data subsequent to transfer or export. LinkedIn agrees to preserve the confidentiality of the Customer Personal Data retained by it and that it will only actively process such Customer Personal Data after such date in order to comply with applicable Data Protection Requirements. For clarity, after termination of the LinkedIn Contract, LinkedIn may continue to process Customer Personal Data that has been aggregated in a manner that does not identify individuals or customers to improve LinkedIn’s systems and services.
Sections 9 and 10 of the DPA will not apply in the context of Glint products or services.
Annex II to the SCCs
TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA
1.General Security Measures
Data Importer will comply with industry standard security measures (including with respect to personnel, facilities, hardware and software, storage and networks, access controls, monitoring and logging, vulnerability and breach detection, and incident response measures necessary to protect against unauthorized or accidental access, loss, alteration, disclosure or destruction of Data Exporter's Personal Data provided by Data Exporter to Data Importer), as well as with all applicable data privacy and security laws, regulations and standards.
Data Importer's security team can be reached at email@example.com for any security issues or questions related to the product.
Data Importer complies with the standards and practices set forth at the following web address: https://security.linkedin.com/trust-and-compliance. Data Exporter must contact their LinkedIn account manager for any additional information on the security certifications listed at the web address.
4.Information Security Program
The objective of LinkedIn Information Security Program is to maintain the confidentiality, integrity and availability of its computer and data communication systems while meeting necessary legislative, industry, and contractual requirements. Data Importer shall establish, implement, and maintain an information security program that includes technical and organizational security and physical measures as well as policies and procedures to protect Data Exporter data processed by Data Importer against accidental loss; destruction or alteration; unauthorized disclosure or access; or unlawful destruction.
4.1Secure Software Development
Data Importer shall maintain policies and procedures to ensure that system, device, application and infrastructure development is performed in a secure manner. This includes review and test of all Data Importer applications, products and services for common security vulnerabilities and defects, employing defense-in-depth strategy through the use of multiple layers of security boundaries and technologies, periodic pen testing and security assessment of these services, defining baseline configurations and requirements for patching of third party systems.
4.2Human Resources Security
Data Importer shall maintain a policy which defines requirements around enforcing security measures as they relate to employment status changes. This includes background checks, acknowledgement and adherence to Data Importer's security policies, onboarding and termination for employees and third parties.
4.3Data Classification & Protection
Data Importer shall maintain policies and procedures for data classification and protection, along with requirements for classification of data containing Personal Data in consideration of applicable laws, regulations and contractual obligations. Data Importer shall also maintain requirements on data encryption, rules for transmission of data and requirements for removable media, along with requirements on how access to these data should be governed.
Data Importer shall maintain policies and procedures around the network infrastructure used to process Data Exporter data, establish and enforce safe network practices, and define service level agreements with internal and external network services.
4.5Physical and Environmental Security
Data Importer shall maintain policies and procedures for physical and environmental security, define requirements to protect areas that contain sensitive information and ensure that critical information services be protected from interception, interference or damage.
4.6Business Continuity and Disaster Recovery
Data Importer shall maintain policies and procedures to ensure that Data Importer may continue to perform business critical functions in the face of an extraordinary event. This includes data center resiliency and disaster recovery procedures for business-critical data and processing functions.
Data Importer shall maintain access control measures designed to limit access to Data Importer's facilities, applications, systems, network devices and operating systems to a limited number of personnel who have a business need for such access. Data Importer shall ensure such access is removed when no longer required and shall conduct access reviews periodically.
Data Importer has a documented risk management procedure and Secure Software Development LifeCycle process. Data Importer performs risk assessments of its products and infrastructure on a regular basis, including review of the data classification policies and targeted reviews of highly sensitive data flows.
Data Importer performs application and infrastructure level testing for every new product that is launched as well as periodic reassessments of its network, as well as feature changes. Data Importer leverages access control, and peer code review which would ensure that viruses are not introduced in the code and detect such abuse. Data Importer uses a combination of manual penetration testing and automated tools.
7.Third-Party Risk Assessments
Data Importer conducts security due diligence on third-party service providers to assess and monitor risk. This assessment includes a review of scope of confidential information and personal data transferred to or processed by the service provider and the purpose of the work. Data Importer will also conduct a risk assessment which may include the service provider’s organization and technical security measures, the sensitivity of any information processed by the service provider, storage limitations, and data deletion procedures and timelines.
In addition to the general security measures set out above, the Data Importer has implemented the following supplementary technical and organisational measures:
- Customer Personal Data as defined in the Data Processing Agreement is transferred across public networks to the Data Importer’s data centres in the United States and is stored on secured servers behind firewall.
- New Glint Customers may select between the Glint US or Glint EU data storage locations for hosting of their Glint-specific Customer Personal Data.
- Data Importer encrypts all Customer Personal Data in transit across public networks depending on the Data Exporter’s ability to support encryption. Certain highly confidential data (including but not limited to passwords, authentication tokens, salary and payment information) is also encrypted at rest. LinkedIn will only use industry tested and accepted standards for cryptographic algorithms.
- Data Importer’s data is replicated across all its data centres in a secure environment.
- Data Importer employs app logic with appropriate authorization to protect tenant data. Access requests are reviewed to ensure only appropriate access is granted. Server and database access logs are retained for auditing purposes.
- Data Importer deploys industry standard security measures for all of its product lines as further set forth at https://security.linkedin.com/trust-and-compliance, including 27001 & ISO 27018 and PCI DSS for Data Importer’s Talent Solutions, Learning Solutions, Marketing Solutions and Sales Solutions. Data Importers’ employees and contractors are trained in relation to specific technical and organisational security measures.
- Servers are monitored by both industry standard and proprietary network monitoring tools to prevent any potential security breaches.
- Corporate systems and databases are password protected.
- VPN and direct LinkedIn network access are limited to company issued or approved devices.
- Dual factor authentication is in operation for VPN access.
- Customer and member passwords are hashed and salted and stored in a separate, secure database.
- Keys to credit card database are rotated regularly.
- Active and automated monitoring of critical access logs and anomaly detection.
Do you always need a data processing agreement? ›
When is a contract needed and why is it important? Whenever a controller uses a processor to process personal data on their behalf, a written contract needs to be in place between the parties.What should a data processing agreement include? ›
- the subject matter and duration of the processing;
- the nature and purpose of the processing;
- the type of personal data and categories of data subject; and.
- the controller's obligations and rights.
The Purpose of a DPA
A data processing agreement lays out technical requirements for the controller and processor to follow when processing data. This includes setting terms for how data is stored, protected, processed, accessed, and used. The agreement also defines what a processor can and cannot do with data.
- Details of the subject matter, duration, nature, and purpose of the processing.
- Details of the categories of personal data and data subjects.
- Obligations of the data controller.
- Obligations of the data processor, including:
- Any other applicable or optional clauses including:
Fines. The Information Commissioner has the power to issue fines for infringing on data protection law, including the failure to report a breach. The specific failure to notify can result in a fine of up to 10 million Euros or 2% of an organisation's global turnover, referred to as the 'standard maximum'.Can you refuse to comply with data requests? ›
You can refuse to comply with a request that is vexatious. If so, you do not have to comply with any part of it, or even confirm or deny whether you hold information.How do you complete a DPA? ›
- The subject of the agreement – typically that would be all activities related to the contractual relationship between partners.
- The scope, nature and duration of data processing – how personal data will be used and which party will be responsible for compliance of the process.
There are three main data processing methods - manual, mechanical and electronic.What are the 5 parts of data processing? ›
Data Processing refers to converting raw data into meaningful information, and these data are machine-readable as well. Thus, data processing involves collecting, Recording, Organizing, Storing, and adapting or altering to convert the raw data into useful information.Is DPA mandatory? ›
Under the GDPR, a DPA document is mandatory whenever a person or organization gives personal data to a third-party service provider for a collaborative service. Any parties that act as data processors must sign DPAs with the data controllers.
What are the 4 elements of data processing system? ›
- Data collection.
- Data input.
- Data processing.
- Data output.
- Contractual obligations.
- Legal obligation.
- Vital interests.
- Public interests.
- Legitimate interests.
- Data Collection. You can't process what you don't have. ...
- Data Preparation. In order to be able to use the data, it must be cleansed, sorted, and filtered. ...
- Data Inputting. ...
- Data Processing. ...
- Data Output. ...
- Data Storage.
VPN use, spelled out
A VPN-use agreement should cover a wide range of details. This includes how much access is acceptable and at what times, what users must do to recertify and revalidate themselves to the VPN, and what kinds of user devices are authorized on what types of connections.
What is the Data Processing Agreement for GDPR? Article 28(3) of GDPR requires that controllers, processors, and sub-processors must enter into written contracts, or data processing agreements, in order to share personal data.How much can you be fined for DPA? ›
Under the GDPR, the EU's data protection authorities can impose fines of up to up to €20 million (roughly $20,372,000), or 4% of worldwide turnover for the preceding financial year – whichever is higher.Can you get fired for a data breach? ›
A significant or deliberate breach, such as accessing or disclosing personal data without authority, is gross misconduct and could lead to dismissal or a contract being terminated.What happens if you accidentally breach GDPR? ›
Data controllers must notify a personal data breach to the supervisory authority without undue delay and, where feasible, not later than 72 hours after becoming aware unless the breach "is unlikely to result in a risk to the rights and freedoms of natural persons".How long do you have to respond to a data subject rights request? ›
An organisation normally has to respond to your request within one month. If you have made a number of requests or your request is complex, they may need extra time to consider your request and they can take up to an extra two months to respond.What happens if someone doesn t respond to a subject access request? ›
If you fail to comply with a SAR, the requester may apply for a court order requiring you to comply. It is a matter for the court to decide, in each particular case, whether to make such an order.
Do I have to give a reason for a subject access request? ›
Yes. You need to be satisfied that you know the identity of the requester (or the person the request is made on behalf of). If you are unsure, you can ask for information to verify an individual's identity. The timescale for responding to a SAR does not begin until you have received the requested information.What to look for when reviewing a DPA? ›
- The purpose and categories of data to be processed.
- The duration of processing.
- The categories of data subjects.
- The rights and the duties of the data controller.
- That the data processor will process data only upon the written instruction, i.e. the DPA.
- Recognise the subject access request.
- Identify the individual making the subject access request.
- Act swiftly and clarify the subject access request.
- identify personal data to be disclosed. ...
- Identify personal data exemptions.
Under data protection law, anyone can ask if your organisation holds personal information about them - you must respond to their request as soon as possible, and within one month at most. Requests for personal data should be provided for free in most cases.Which types of data processing are most widely used? ›
This is the most commonly used data processing technique. However, it is used all over the globe where we have computer-based setups for Data capture and processing. As the name suggests – Multiprocessing is not bound to one single CPU but has a collection of several CPUs.
Data processing refers to the manipulation and collection of data to generate meaningful information by a computer. It may include the transfer of raw data to a machine-legible form, managing the flow of data through the CPU or any memory to an output device, and conversion of output.What counts as processing personal data? ›
It includes the collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of personal data.What are examples of data processing? ›
- Electronics. A digital camera converts raw data from a sensor into a photo file by applying a series of algorithms based on a color model.
- Decision Support. ...
- Integration. ...
- Automation. ...
- Transactions. ...
- Media. ...
- Communication. ...
- Artificial Intelligence.
3 C's of Data Protection - Cost, Complexity, Capability - Data Protection - Blogs - Quest Community.What are the 3 activities involve in data processing? ›
Data processing may involve various processes, including: Validation – Ensuring that supplied data is correct and relevant. Sorting – "arranging items in some sequence and/or in different sets." Summarization(statistical) or (automatic) – reducing detailed data to its main points.
Who is responsible for DPA? ›
As the authority who is responsible for enforcing the Data Protection Act, the ICO has the ability to levy considerable penalties against organisations failing to comply with data protection. Though decisions made by the Commissioner are subject to appeal to an independent tribunal and the courts.What are the 8 principles of DPA? ›
|Principle 2 – purposes||Principle (b) – purpose limitation|
|Principle 3 – adequacy||Principle (c) – data minimisation|
|Principle 4 – accuracy||Principle (d) – accuracy|
|Principle 5 - retention||Principle (e) – storage limitation|
UK GDPR personal data breach (DPA 2018)
A breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.
There are three main steps – data collection, data storage, and data processing. Data can be collected manually or automatically. Once done, it must be stored. Processing is how big data is transformed into useful information.What is not classed as personal data? ›
Information about companies or public authorities is not personal data. However, information about individuals acting as sole traders, employees, partners and company directors where they are individually identifiable and the information relates to them as an individual may constitute personal data.How many grounds do you need to lawfully process data? ›
There are six lawful grounds, which are summarised below. Consent: The data subject has consented to the personal data processing.Which two of the following must always be true when we process personal data? ›
Personal data shall be: processed lawfully, fairly and in a transparent manner in relation to the data subject ('lawfulness, fairness and transparency');What are the 14 steps in data processing? ›
- Data Collection. The primary stage in the data processing cycle involves collecting raw data acquired from standard sources such as data warehouses and data lakes. ...
- Data Preparation. ...
- Data Input. ...
- Data Processing. ...
- Output. ...
- Storage. ...
- Manual Data Processing. ...
- Mechanical Data Processing.
Solution(By Examveda Team) Immediate-sequential is not a practical data-processing approach.What is the difference between VPN and dVPN? ›
A dVPN is the acronym for “decentralized virtual private network.” Like a VPN, a dVPN encrypts data, masks the IP address, and allows you to access the internet anonymously. However, the decentralized VPN service removes the dependency on closed, proprietary VPN servers.
What are the 4 main benefits of using a VPN? ›
- Bypass Geo-locked Content. Many popular entertainment websites have different content accessible in specific regions. ...
- Provide Safety Through Anonymity. ...
- Save Money on Region-Based eCommerce. ...
- Cost-Effective Security. ...
- Gaming Pros.
Do I need to have a Data Processing Agreement? If you exchange personal data with other parties, you should have a Data Processing Agreement in place. Articles 28 through 36 of the GDPR cover the requirements for data processing and data processing agreements.Can you process data without consent? ›
In summary, you can process personal data without consent if it's necessary for: A contract with the individual: for example, to supply goods or services they have requested, or to fulfil your obligations under an employment contract. This also includes steps taken at their request before entering into a contract.Do all firms need a DPO? ›
Do we need to appoint a Data Protection Officer? Under the UK GDPR, you must appoint a DPO if: you are a public authority or body (except for courts acting in their judicial capacity); your core activities require large scale, regular and systematic monitoring of individuals (for example, online behaviour tracking); or.Is a DPO mandatory? ›
Public administrations always have an obligation to appoint a DPO (except for courts acting in their judicial capacity). The DPO may be a staff member of your organisation or may be contracted externally on the basis of a service contact. A DPO can be an individual or an organisation.What counts as processing data GDPR? ›
It includes the collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of personal data.What are the 7 GDPR requirements? ›
According to the ICO's website, The GDPR was developed based upon seven principles: 1) lawfulness, fairness and transparency; 2) purpose limitation; 3) data minimization; 4) accuracy; 5) storage limitation; 6) integrity and confidentiality (security); and 7) accountability.Can a DPO be fired? ›
The GDPR also affords certain protections: The DPO can't be dismissed as a result of doing their job, even if saying “no” to management means there's a conflict of interest. In general, an organization can choose to hire a data protection officer externally or appoint one internally.Can a DPO be dismissed? ›
Article 38(3) of the GDPR expressly states that '(…) the data protection officer (…) shall not be dismissed or penalised by the controller or the processor for performing his tasks. ' It establishes an additional guarantee for DPOs who cannot be dismissed for the mere performance of their duties as DPOs.What are the 5 key responsibilities of a DPO? ›
- Uphold data protection laws and practices. ...
- Monitor compliance. ...
- Support business operations and data handling. ...
- Notify teams and authorities of data breaches. ...
- Foster a security-aware culture.
Do Startups Need a DPO? ›
Data Protection Officers (DPOs) need to be appointed when there is large scale processing of personal data. It is unusual for a startup to process sufficiently large amounts of data to require a DPO. However, if you are looking to scale up your business, you can consider appointing a DPO on an ad-hoc basis.How long does it take to become a DPO? ›
5 years of experience within a compliance, legal, audit and/or risk function, with recent experience in privacy compliance. At least 2 years of experience with GDPR and working knowledge of CCPA.How long does a DPO have to report? ›
New data breach notification requirements
The DPO, is responsible for ensuring that all relevant data protection breaches are reported to the ICO without delay and no later than 72 hours after having become aware of it, unless the data was anonymised or encrypted.