The law of commercial profiling

Abstract

New technological developments and the large amount of databases nowadays enable the use of profiling practices which collect, combine, analyse and automatically categorise data into groups. This automatic categorisation and identification of individuals’ data enables business and governmental entities to classify individuals into certain profiles. Although such resulting profiles can help business entities to identify current or potential targets for their own benefits and decision-makings, profiling is likely to generate certain prejudicial treatments for the individuals, which may threaten their privacy and data protection rights, as personal and sensitive information may be revealed. By monitoring all individuals’ activities, profiling enables different types of information to be merged to link to individuals’ offline lives and thus to their physical identities. As such, profiling challenges the protection of individuals’ fundamental rights and values and creates conditions for surveillance, manipulation, threats to individuals’ autonomy, discrimination, deindividuation, stigmatisation, stereotyping and inaccuracy in the decision process. In addition, the asymmetries of knowledge and the unbalanced distribution of powers between the controllers and the data subjects are likely to affect the individuality of a person and generate concerns over their autonomy and their right to selfdetermination. Privacy and data protection are recognised as legal instruments which protect the rights of the individuals to preserve their freedom to develop their own unique identities and individuality within society. This thesis is limited to profiling practices operating in the private sector for commercial purposes. Extensive use has been made of primary sources, such as legislation, and other secondary materials, such as journals and textbooks, for the preparation of this thesis. The findings of this thesis argue that profiling contradicts the idea of transparency and the selfdeterminatory (controllable) nature of data protection legislation, and thus of the GDPR. In practice, the law is ineffective to safeguard the protection of individuals’ fundamental rights to privacy and data protection in the context of profiling: consent as a control mechanism has proven to be a pseudo-right under which individuals are giving their consent mechanically and unconsciously and thus it cannot be considered as the freely given, specific, informed and unambiguous indication of the individuals’ wishes; the de-individuated character of profiling makes individuals who have no interest either in exercising such control or to live a self-determined existence, and what is more, individuals are neither aware, nor able to be aware, that they are in this situation; profiling, as a Panopticon, corrects and controls individuals’ behaviour without allowing individuals to freely exercise control over their data in order to make their own autonomous decisions and choices. It is, therefore, my opinion that the exercise of control should be left to the legislator rather than to the individuals themselves. Profiling constitutes a humanitarian issue and must be governed within the sphere of humanitarian law, as a stand-alone law of profiling in combination with fundamental human rights-based law.