Risks of Profiling and the Limits of Data Protection Law - Discrimination and Privacy in the Information Society - page 138

the combination of certain 'identifiers' that hold a particularly privileged and close
relationship to the individual. 6 Common identifiers are: name, physical appear-
ance, and certain unique numbers such as a social security number. The extent to
which certain identifiers are sufficient to achieve identification depends on the
context of the particular situation. 7
Van den Hoven explains that the data used in an identification process are ref-
erential , meaning that the data refers to a specific person, not just any person
(Van den Hoven 2008, p. 309) This means that personal data always need an iden-
tity-relevant context. Without such context data have no meaning and are just at-
tributive : they would describe a situation or fact without reference to any specific
individual. One could argue that attributive data are conditionally referential ; they
can become personal data if another identity-relevant condition occurs, for in-
stance because the raw data are placed in an identity-relevant context or combined
with a piece of identity relevant information (Terstegge 2009). So while an indi-
vidual might not be directly identified on the basis of a unique identifier such as a
name, he or she may nonetheless be 'identifiable'. In the context of profiling three
situations may occur that would render attributive data referential, personal data.
They are: 1) adding identifying data to a profile, 2) spontaneous identification
based on the uniqueness of the profile, 3) linking the profile to an individual by
means of unique identifiers.
The first situation occurs when referential data (personal data) is added to at-
tributive data. By adding information that is considered uniquely identifying (e.g.,
full name, date of birth, address) to a profile, all the data in that profile will be-
come personal data.
The second situation occurs when the data contained in a profile leads to the
spontaneous identification of the data subject. This is the case when the constella-
tion of data is considered so unique, that the profile can only fit a single person
and that person can be identified on the basis of the profile. 8 A well-known exam-
ple of this is the case of 'AOL searcher 4417749'. In 2006 AOL published an ano-
nymised dataset consisting of search queries for research purposes. But it did not
take researchers long to trace back the search queries of an anonymous user
(4417749) to her real name: Thelma Arnold (Barbaro and Zeller 2006). The com-
binations of search queries were so unique for each individual that they were able
to trace back the queries to Ms. Arnold.
The third situation occurs when the profile of a data subject is associated with
unique identifiers that are closely associated with him. Apart from identification
on the basis of unique attributes such as for instance name, address and/or social
security number, a profile may also be linked to a natural personal via other
means. Most often this will be the case with profiling, since profiling is only effec-
tive if the data subject can be somehow be linked to the relevant profile. Apart
from using identifiers that are unique to the data subject (e.g., name, address, place
and date of birth), other types of identifiers may also be used. A common method
is to link a data subject to a profile through the terminal equipment (e.g., mobile
6 Opinion Nº 4/2007 on the concept of personal data, Article 29 Working Party, p. 12.
7

Opinion Nº 4/2007 on the concept of personal data, Article 29 Working Party, p. 12.

8

Opinion Nº 4/2007 on the concept of personal data, Article 29 Working Party, p. 13.