An investigation by Ireland’s Data Protection Commission (DPC) found that LinkedIn had processed hashed email addresses of approximately 18 million non-LinkedIn members and targeted these individuals on Facebook without necessary permission, a new report has revealed.

The investigation revealed that that LinkedIn Corporation in the US did not have the required permission from the data controller – LinkedIn Ireland — to process hashed email addresses of 18 million non-LinkedIn members.

“Unfortunately the strong processes and procedures we have in place were not followed and for that we are sorry. We’ve taken appropriate action, and have improved the way we work to ensure that this will not happen again,” Kelleher said.