DP2017: Profiling â The loves, the hates, the risks and the changes

Estelle Dehon is a Barrister at Cornerstone Barristers and led DP2017’s breakout session on profiling through why we love it as an industry, why customers might not feel the same way and the key things to be aware of under GDPR.

“Profiling is a particularly key and interesting area for marketing under GDPR. There’s a lot of good that profiling can achieve, like delivering better targeted and relevant messages to consumers.

She explained how profiling is the bread and butter of delivering more targeted, relevant marketing that consumers value. It leads to better market segmentation, tailored offers and a better online experience for customers.

“Why people don’t love profiling is also, in part, down to this same targeting. Nobody wants to feel freaked out by ads following them around their digital lives. From their mobile phone, to their tablet and then to their laptop.”

But what does GDPR mean for profiling? Most importantly, it newly defines the term in data protection law. ‘Profiling’ can be understood as having 3 key components: a form of automated processing, be performed on personal data (including the addition of non-personal data) and has the aim of evaluating personal attributes of an individual or individuals.

“Automated processing is the key challenge. Profiling isn’t defined as ‘solely automated processing’, so can include processes where human intervention is involved.”

It can also involve a wide range of data sources, from existing customer data and buying habits to biometric data and information from Internet of things devices. It can also involve a number of types of processing of personal information, including:

• Obtaining personal information from various sources (including potentially public sources)
• Analysing or assessing that information
• Creating new data in the form of the profile
• Storing both the base data and the new data

“Automated processing can involve a mix of personal and non-personal data too. Only completely anonymised data would not fall under GDPR. Otherwise all of these processes must comply with the GDPR principles and have a lawful basis.”

“Profiling is often not as transparent as other forms of processing. Under the principle of transparency, you need to tell people when you’re profiling them.

“It can also include hidden biases and emphasise existing stereotypes or social segregation, so we need to guard against this by weeding out any possible algorithm bias.”

“We need to consumer the legal basis for processing too, whether it’s under consent, necessary performance of contract or legitimate interests.”

“Most importantly for marketers, for the first time the GDPR explicitly states that direct marketing is a legitimate interest. However, the more extensive or intrusive the profiling for direct marketing, the more likely it is to infringe the individual’s rights and thus not fulfil the processing condition.”

“There are also a number of rights given to individuals under GDPR, such as the right to object, the right to correction inaccurate data and the right to erasure. Not to mention the right not to be subject to automated decision-making, including profiling.”

Going on to explain some of the detail around solely automated decision-making and individuals right to object if this produces legal effects or ‘significantly effects’ him or her.

“If it doesn’t have a legal effect or a significant effect, it’s not the sort of processing we should be worried about.”

Estelle then signed off with a brief video showcasing the possible pitfalls of profiling (below), then commenting:

“This may well be a moment of fundamental change. We get massive services at the moment under a quid pro quo for our information. GDPR means a potential change in how we pay for these services in the future.”