EU Position on Behavioural Profiling Clarified

The Article 29 Working Party, the EU body that plays a big role in steering privacy and data protection policy and legislation, has this week published an opinion that would seem to confirm some of the worst fears of the online and direct marketing community in respect of the proposed changes to data protection law.

Although these opinions do not carry any legal weight in themselves, they do highlight the intended effects of privacy legislation.  Also, as the Article 29 group is made up of the data protection authorities in each member state, including the UK’s ICO, these opinions are also representative of the collective views of the enforcers of the data protection laws.  This makes them an important group to pay attention to.

The opinion is about the purpose limitation principle of data protection.  In a nutshell this is that personal data should be collected only for specified purposes, and should not be processed in a way that is incompatible with that purpose.  This is a relatively simple idea on the surface of it, but as ever, becomes heavily nuanced when you get into the details.

The opinion document itself stretches to 70 pages of pretty dense text – which itself should give an idea of how nuanced this can get.  Fortunately however, most people don’t need to read it all to gain an understanding of the key issues.  Turn to Annexes 3 and 4 right at the back and the examples of data use and re-use are a great way to understand what all this means in real life.

However, one section of the document dealing with big data is very explicit about the requirements for use of behavioural profiling in online advertising.

“[Opt-in] consent should be required, for example, for tracking and profiling for purposes of direct marketing, behavioural advertisement, data-brokering, location-based advertising or tracking-based digital market research”

And

“For the consent to be informed… data subjects… should be given access to their ‘profiles’, as well as to the logic of the decision-making (algorithm) that led to the development of the profile”

This is a pretty clear position that many organisations that rely on big data analytics will be very uncomfortable with. Especially as revealing their algorithms could make a large part of their competitive differentiation vanish in a puff of smoke.

However, it seems that some at least are seeing such requirements as becoming inevitable.  This week, Facebook announced that it is working with advertising partners to give its users visibility and control over the display of targeted ads. 

At the same time one of those partners Acxiom has revealed that it plans to develop tools for the 700 million or so consumers in its database, to see what it knows about them.