In the latest input to the data protection reform discussions, the Article 29Working Party has published an advice paper on profiling, setting out some further guidance and indicating a preferred definition.
The Working Party believes that connecting personal data to create and use profiles has become an important challenge for individuals’ rights and freedoms. Profiling is seen by them as enabling companies and public authorities to determine, analyze or predict peoples’ personality or aspects of their personality – especially their behaviour, interests and habits. Furthermore, the Article 29 Working Party are concerned that people understand little about profiling and usually do not know to what extent they are being profiled.
The Working Party argue that, due to the widespread availability of personal data on the Internet, the increasing possibilities of linking such data and the fact that technical devices operating on the basis of processing personal data pervade our everyday lives, profiling has become one of the biggest challenges to privacy.
These concerns are the spring from which the latest advice paper arises.
The Article 29 Working Party considers that a clear definition on profiling must be included in the proposed new General Data Protection Regulation and have put forward concrete wording based on the Council of Europe’s recommendation on profiling of 2010. In addition, the Working Party makes some proposals to improve Article 20 of the General Data Protection Regulation which is the provision on profiling:
· the scope of the provision should be broadened in order to include the collection and creation of profiles as such;
· the lack of transparency has to be repaired by guaranteeing additional information rights and a higher level of control for individuals;
· accountability and responsibility of data controllers have to be strengthened by establishing specific safeguards to protect data subjects’ rights, eg by creating an obligation to anonymise or pseudonymise personal data;.
· a balanced approach taking the different categories of profiling and the different risks for the individual’s rights into account is necessary – the European Data Protection Board should play a strong role by issuing guidelines on the interpretation and application of provisions on profiling.
The advice paper can be accessed in full here.
