Definition:
Profiling (international trade law) (Es: elaboración de perfiles, Fr: profilage, Ro: creare de profiluri) = the automated processing of personal data consisting of the use of personal data in order to evaluate certain aspects relating to a natural person, according Article 4 (1) of the EU General Data Protection Regulation. This type of data processing is used to analyse or predict behaviour, movements, preferences or any other issues of interest relating a natural person.
Profiling involves categorising individuals according to their personal traits. There are two types of characteristics: ‘unchangeable’ (such as age or height) and ‘changeable’ (such as habits, interests, preferences or any other elements referring to behaviour). Through the process of profiling, individuals are categorised according to their observable characteristics in order to determine others that are not observable, with a certain margin of error.
The practices involving profiling are used to either generate knowledge, by analysing existing data to make assumptions about a natural person, using past experiences, statistical information to correlate certain aspects and particular outcomes or behaviour, either to support the decision-making processes by using the aforementioned correlations to make decisions and act in certain situations.
Profiling is a process that carries some significant risks such as:
- establishing general correlations that might prove untrue for each individual, making any given natural person to be the ‘exception to the rule’,
- generating incorrect correlations depending on the criteria used for the process,
- creating stereotypes and leading to discrimination,
- resulting in a person being treated as part of a group rather than as an individual based on stereotypical criterion.
Profiling uses an algorithmic profiling process with several steps:
- the preparatory phase – in which the algorithm is designed and developed and the goal of the analysis is set,
- step 1 – in which data are gathered either by authorities or public bodies or purchased from private actors,
- step 2 – in which data is analysed for the determination of patterns and correlations,
- step 3 – in which the resulting data is interpreted, identifying behavioural patterns for given groups of individuals and decisions can be made on the basis of such predictions/profiles.
This process is complex as it involves the work of collecting, preparing and analysing data and the way in which data are collected and used can be discriminatory as a very important aspect of the entire process is the human involvement.
Profiling is deemed unlawful if it includes acts of unjustified differential treatment of individual on the basis of protected grounds or it unnecessarily interferes with the private lives of the natural persons and it is not in accordance to personal data protection rules.
Useful links:
Legislation
https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679 – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) [English]
https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016L0680 - Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA [English]
https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:31995L0046 – Directive 95/46/EC of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data, (no longer in force) [English]
https://www.dataprotection.ro/servlet/ViewDocument?id=35 – Legea nr. 677/2001 pentru protecția persoanelor cu privire la prelucrarea datelor cu caracter personal și libera circulație a acestor date / Law no. 677/2001 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, (no longer in force) [Romanian]
Case Law
https://www.courdecassation.fr/communiques_4309/contr_identite_discriminatoires_09.11.16_35479.html - Decision 1245 of 9 November 2016, Court of Cassation, France [French]
http://curia.europa.eu/juris/document/document.jsf;jsessionid=EDD22C6051CD3AA5293CEB3B78E706FA - The European Court of Justice, Judgement of 16 December 2008, Heinz Huber v Bundesrepublik Deutschland, C-524/06, EU:C: 2008:724 [English]
Online Publications
Lammerant, H., & de Hert, P. (2016). Predictive profiling and its legal limits: Effectiveness gone forever. In B. van der Sloot, D. Broeders, & E. Schrijvers (Eds.), Exploring the boundaries of big data (Vol. 32, pp. 145-173). Amsterdam University Press/WRR, retrieved from https://research.tilburguniversity.edu/en/publications/predictive-profiling-and-its-legal-limits-effectiveness-gone-fore [English]
Schomm F., Data Profiling as a Process. Bridging the Gap between Academia and Practitioners, GvD, 2016 retrieved from http://ceur-ws.org/Vol-1594/paper18.pdf [English]
Practical Use
European Union Agency for Fundamental Rights (FRA), Preventing unlawful profiling today and in the future: a guide, Luxembourg, Publications Office, 2018 [English]
European Union Agency for Fundamental Rights (FRA), European Data Protection Supervisor (EDPS) and the Council of Europe (2018), Handbook on European Data Protection Law – Edition 2018, Luxembourg, Publications Office, May 2018 [English]
European Union Agency for Fundamental Rights (FRA), Hate Crime Recording and Data Collection Practice Across the EU, Luxembourg, Publications Office, 2018 [English]
Article 29 Data Protection Working Party, Guidelines on Automated Individual Decision-Making and Profiling for the Purposes of Regulation 2016/679, WP251 rev.01, 6 February 2018 [English]