There are coming interesting times for the advertisement industry with the introduction of the GDPR law or as official called Directive 95/46/EC (General Data Protection Regulation) within the EU.
For example about profiling, the law explicit mentioned about profiling.
Ed Kassens from Whooz wrote an interesting article (in Dutch) about the possibilities and limitations of profiling, called
Is profiling now prohibited with the GDPR?
Below a summery from the Dutch article with my personal opinion concerning the directive.
That the arrival of the AVG creates uncertainty among many marketers and compliance managers may be clear. The question of what is profiling in particular raises a lot of uncertainty. Because is profiling prohibited in the future?
Most organizations have been discussing the new guidelines and implementing processes to comply with the guidelines. Unfortunately the guidelines are not so clear yet. Many people think that profiling is forbidden. According to Ed, that is not the case, there are only a few rules about profiling.
What is meant by profiling and in what circumstances is profiling allowed?
Definition of profiling
According to Wikipedia Profiling (information science) is:
In information science, profiling refers to the process of construction and application of user profiles generated by computerized data analysis.
This involves the use of algorithms or other mathematical techniques that allow the discovery of patterns or correlations in large quantities of data, aggregated in databases. When these patterns or correlations are used to identify or represent people, they can be called profiles. Other than a discussion of profiling technologies or population profiling, the notion of profiling in this sense is not just about the construction of profiles, but also concerns the application of group profiles to individuals, e. g., in the cases of credit scoring, price discrimination, or identification of security risks.
Ed mentioned about the article 29 working group (WP29) that developed the guideline for profiling on behalf of the European Commission. The WP29 defines profiling as
Definition of profiling by WP29
any form of automated processing of personal data consisting of the use of personal data to evaluate
certain personal aspects relating to a natural person, in particular to analyse or predict aspects
concerning that natural person’s performance at work, economic situation, health, personal
preferences, interests, reliability, behaviour, location or movements;
Ed mentioned, so working with scoring models, generic customer and audience segmentations and personas is indeed covered by profiling.
When is profiling allowed?
It is not the case that profiling or working with personas within the GDPR (or AVG in Dutch) is forbidden.
The WP29 group explains profiling is not allowed in the context of fully automated decision-making that has legal consequences for an individual or that affects him/her to a considerable extent. Significant extent is also specified:
- If profiling has a significant impact on the circumstances, behavior or freedom of choice of individuals.
- If profiling has a long-term or lasting effect on the individual
In the most extreme case, if profiling leads to exclusion or discrimination against individuals.
So how can we use profiling?
You can not therefore limit the freedom of choice of an individual to a large extent or exclude or discriminate against him. But if you do not plan that, nothing is wrong.
For example, you can selectively send advertising on the basis of target group segmentation and personas. Not receiving an advertisement is not considered striking an individual to an appreciable extent. The interest of an individual is not harmed because he or she has received an advertising message or not. The same applies to making choices about which content you want to show first to a visitor on your website, based on personas. The most important thing is that in all forms of profiling you think carefully about the extent to which this has an impact on the individuals on whom you involve the personas. This is expressed, however, in the decisions you make about individuals and not in the profiling processing method itself. A reassuring thought for those who have set up their marketing processes on the basis of profiling.