Also, I just checked, and LinkedIn's privacy policy page doesn't contain any information about who viewed my profile in the last year. No usernames, no company names, it's just a generic privacy policy. So the data isn't there either.

It falls on its face as soon as they offer to sell that data to someone else, which is exactly what they're doing. Can't have it both ways.

"personal data’ means any information relating to an identified or identifiable natural person" - GDPR article 4

Data often pertains to multiple people (trivial case: direct messages between two users); the rights of GDPR apply to your data, regardless of whether it also pertains to multiple others, subject to some restrictions to safeguard the rights of others. Those legal restrictions clearly don't apply because you could pay to obtain that access.

LinkedIn would need to prove in court that the list of users who visited your profile is not your data.

Additionally, your profile is undisputably your data. Per article 15 of the GDPR, you have a right to access "the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations".

I don’t think anyone has tested that in court. I wouldn’t be surprised if it should belong to you but fact that most CCTV footage is (or at least was) stored by small independent entities means that you aren’t aware that your CCTV data exists, or wouldn’t find it worthwhile to request it all.

It would be an interesting angle of attack against classic surveillance, though. If there are any vendors that store the video in some centralized system, so you can request it all at once.

But, I think there will be some hurdles, this case specifically relies on the fact that LinkedIn clearly doesn’t believe there’s any reason to keep this data private (they sell users access to it, after all).

That is true in the EU in a number of circumstances. You can do a data access request for CCTV footage of yourself; I’ve successfully done this before, and some organizations give out CCTV footage this way often enough they have websites about their procedures. For organizations I know of, they blur other people in the footage.

Yes, of course. In European cities there are GDPR disclosures hanged on the lampposts on which CCTV cameras are mounted. The disclosure contains retention period and contact to data processing inspector where you can request the data. You probably need to specify the timestamps and haw to recognise you.

In commercial buildings the disclosure may hang on the wall besides main entrance.

Everything as designed.

"Pertains" is doing a lot of work in your argument, and you're using it wrong. The data about who viewed your profile pertains to you from the moment the visit happens. That's what that word means, so your first statement is false.

The other important detail is that LinkedIn already has processed this data that definitely pertains to you, whether you paid for it or not, and are trying to sell it to you. In fact, to quote the article, LinkedIn's argument for not giving it to the user is "on the grounds that protecting that data took precedence". LinkedIn isn't withholding viewer data to protect viewer privacy. We know this because they sell it. If the viewer's privacy interest were so compelling that it overrides your Article 15 right (which is what Noyb is referring to), it would also be compelling enough to prevent LinkedIn from selling that same data to Premium subscribers.

The argument being made for this specific feature (not the ones you added) is that you can't simultaneously claim the data is too privacy-sensitive to disclose under GDPR and then sell it as a product feature

> it doesn’t pertain to you until you pay

Respectfully, that's bollocks. The data, by itself, either does, or it does not. Exchange of unrelated money does not change anything in the data itself. IOW, it's the data that matters, not a wannabe-service that is pitched to the rightful owners.