Removed: the LinkedIn contact database, and all collection from users who had chosen to limit the visibility of their profiles.
Outcome: a €240,000 fine in 2024 plus an order to stop collecting and delete; the database went, the €10,000-per-day penalty was never collected, and the order closed in March 2026.
France’s data protection authority (the CNIL) got there by enforcement. KASPR, a contact-data broker, “collected the contact details of LinkedIn users who had expressly chosen to limit the visibility of their profiles”, and kept each record for five years from its last update. The 2024 sanction was a €240,000 fine plus an order to stop collecting from those users and delete what it had taken; where the data could not be told apart, the fallback was to inform the people concerned and use their data for nothing else.
KASPR skipped the fallback — “in order to comply with the order, it chose to delete its database and cease all data collection on LinkedIn” — and the CNIL closed the order in March 2026 without collecting its €10,000-per-day penalty. The remedy that ended the case was not better handling of the data. It was not holding it.
Source: CNIL, closure of the order issued against KASPR (6 March 2026)