Risks of Profiling and the Limits of Data Protection Law - Discrimination and Privacy in the Information Society - page 133

rapid technological developments in the area of profiling and automated decision-
making, it is questionable whether the right to informational privacy and more
specifically data protection law (still) provide an adequate level of protection and
whether they balance the interests of the actors involved effectively.
In this chapter I explore the possible risks associated with profiling and exam-
ine whether the current legal framework can mitigate these risks effectively. 1 I
shall do so by seeking answers to the following questions:
- What risks does profiling pose for individuals (and groups)?
- How are these risks addressed by the current data protection framework?
- Does the current legal framework for data protection provide adequate
protection whilst also taking into account the legitimate interest of
profilers?
After answering these questions I examine what changes might be necessary in
order to mitigate the risks posed by profiling.
7.2 Risks Associated with Profiling
While profiling can be a valuable aid for businesses and governments, profiling
may also entail risks. Risks commonly associated with profiling are: discrimina-
tion, de-individualisation, stereotyping, information asymmetries, inaccuracy and
the abuse of profiles.
7.2.1 Discrimination
Classification and division are at the heart of profiling. As such, discrimination is
part and parcel of profiling. However, there are situations where discrimination is
considered unethical and even illegal. This can occur for instance when a profiling
exercise is focussed on characteristics such as ethnicity, gender, religion or sexual
preference. But even without a prior desire to judge people on the basis of particu-
lar characteristics, there is the risk of inadvertently discriminating against particu-
lar groups or individuals.
7.2.2 De-individualisation
In many cases profiling is in large parts concerned with classification and thus
there is the risk that persons are judged on the basis of group characteristics rather
than on their own individual characteristics and merits (Vedder 1999). Group pro-
files usually contain statistics and therefore the characteristics of group profiles
may be valid for the group and for individuals as members of that group, though
not for individuals as such. For instance, people who live in a particular
neighbourhood may have a 20% higher chance of defaulting their loan than the
1 In discussing data protection legislation, I shall focus exclusively on the EU framework
for data protection.