The Battle for My LinkedIn Account: A Case Study in Corporate Obfuscation and User Rights

Introduction

When a platform like LinkedIn, which serves as a professional lifeline for millions, suddenly restricts access to your account, the consequences can be severe. This is the story of my ordeal with LinkedIn, a journey marked by opaque policies, inconsistent communication, and ultimately, a hard-won victory for user rights.

The Restriction

It started innocuously enough. One day, somewhere in 2024, I found that my LinkedIn account was restricted. I couldn't send connection requests, and my profile was effectively invisible to others. The platform cited "suspicious activity" as the reason for this restriction, but the specifics were vague. No details were provided about what constituted this suspicious activity or how it was detected. Eventually it also got worse and LinkedIn demanded ID verification to get into my account.

The Verification Request

LinkedIn's solution to this mystery was straightforward, if not somewhat alarming: they demanded that I verify my identity by uploading a scanned copy of a government-issued ID, such as a passport or national ID card. After objecting to Linkedin, they alternatively suggested providing a notarized affidavit of identity. This request was framed as a necessary step to ensure account security and prevent unauthorized access.

At first glance, this might seem reasonable. After all, who wouldn't want to protect their account from malicious actors? But here's the catch: LinkedIn could already verify me using my username, password, and two-factor authentication (2FA) which they made me set up. These are standard security measures designed to verify a user's identity. Why, then, was an additional layer of verification—one that involved sharing highly sensitive personal information—necessary?

The Complaint

I was not alone in my skepticism. Many users have raised similar concerns online about LinkedIn's identity verification process. The platform's insistence on ID copies, despite having robust authentication methods in place, raises questions about privacy and the data hunger of Microsoft. Moreover, the lack of transparency about the nature of the "suspicious activity" only deepened my unease. It also seemed that LinkedIn here was making automated decisions based without human interaction and declined to revisit this decision at first.

I decided to push back. I contacted LinkedIn's customer support, expressing my dissatisfaction with their request and demanding an explanation for the account restriction. I also reached out to LinkedIn's Data Protection Officer (DPO), seeking clarity on their policies and the legal basis for their demands. Unfortunately, my inquiries went largely unanswered, leaving me in a state of limbo.

Escalation to the Autoriteit Persoonsgegevens

Frustrated by LinkedIn's lack of responsiveness, I took the next logical step: I filed a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP). The AP is responsible for enforcing data protection laws in the Netherlands, including the General Data Protection Regulation (GDPR), which grants users significant rights over their personal data.

In my complaint, I highlighted three main issues:

1. Account Restriction Without Explanation: LinkedIn had restricted my account without providing a clear reason or allowing me to contest the decision.
2. Excessive Identity Verification: LinkedIn's demand for an ID copy seemed disproportionate, given that they already had other means of verifying my identity.
3. The undocumented and non transparent way of using automated decision making

The AP acknowledged my complaint and began an investigation. Initially, they seemed to side with LinkedIn, citing Article 12 of the GDPR, which allows data controllers to request additional identification in certain cases. However, the AP also recognized the validity of my concerns regarding automated decision-making (Article 22 of the GDPR) and agreed to forward my complaint to the Irish Data Protection Commission (DPC) for further investigation. LinkedIn, as a company operating within the EU, falls under Irish jurisdiction for GDPR purposes.

The Resolution

After weeks of back-and-forth and the intervention of my employer, who is a Microsoft customer, I finally regained access to my LinkedIn account. The exact method of resolution remains unclear, but it seems that LinkedIn may have lifted the restriction without requiring the ID copy. This outcome, while satisfying, left me with more questions than answers. My guess is that they finally realized that the two step authentication that I have configured should be enough to identify me.

Why was my account restricted in the first place? What "suspicious activity" triggered this response? And why did LinkedIn insist on an ID copy when other verification methods were available? These questions remain unanswered, highlighting the broader issue of corporate opacity in handling user accounts.

Because the matter of my access to my own data was resolved the AP concluded the case. They informed me that they can handle complaints about account access and personal data, LinkedIn's specific identity verification requests fall under Article 12 of the GDPR, which allows for additional identification when necessary. The AP noted that determining when such verification is justified is beyond their jurisdiction since LinkedIn operates under Irish supervision for GDPR matters. They mentioned that the complaint about automated decision-making would need to be addressed by the Irish Data Protection Commission. From the DPC I have not received further statements.

Lessons Learned and Recommendations

My experience with LinkedIn offers valuable lessons for other users who find themselves in similar situations. Here are some recommendations based on my journey:

• Document Everything: Keep detailed records of all communications with the platform, including emails, screenshots, and notes on conversations. This documentation can be crucial if you need to escalate the issue.
• Understand Your Rights: Familiarize yourself with data protection laws such as the GDPR. You have the right to know why your account was restricted and to challenge automated decisions.
• Contact the DPO: If the platform's customer support is unresponsive, reach out to their Data Protection Officer (DPO) directly. For LinkedIn, the DPO can be contacted at eu-dpo@linkedin.com.
• Escalate to Authorities: If the platform fails to resolve the issue, consider filing a complaint with your local data protection authority. In the EU, this would be the relevant national DPA or the Irish DPC, as LinkedIn is subject to Irish jurisdiction under GDPR.
• Seek Alternative Verification Methods: If the platform requests an ID copy, inquire about alternative verification methods, such as a notarized affidavit, which may be less intrusive.
• Involve Your Employer: If your LinkedIn account is crucial for your job, consider involving your employer or HR department, as they may have more influence or resources to help resolve the issue.
• Be Patient but Persistent: Resolving such issues can take time, but persistent follow-up and clear communication of your concerns can increase the likelihood of a positive outcome.

Conclusion

My battle with LinkedIn was a frustrating and enlightening experience. It revealed the challenges users face when dealing with corporate policies that prioritize security over transparency and user rights. While I ultimately regained access to my account, the lack of clarity and accountability throughout the process is concerning.

This case underscores the importance of vigilance and advocacy in protecting our digital identities. By understanding our rights, documenting our interactions, and seeking support from relevant authorities, we can hold platforms accountable and ensure that our online presence remains secure and respected.