Whilst the European Parliament and the Council of the EU sharpen their positions on the EU data protection reform, the Article 29 Working Party continues with its visible involvement in the process.
Whilst the European Parliament and the Council of the EU sharpen their positions on the EU data protection reform, the Article 29 Working Party continues with its visible involvement in the process. This time the Working Party has adopted an advisory paper taking a firm view on the issue of profiling.
The Working Party appears to sit somewhere in the middle between the Commission's proposal and Albrecht's approach. That is still a very strict position to adopt, clearly aimed at eliminating the perceived risks of profiling (although such risks are not identified in the paper).
On the one hand, the Working Party's advice takes a more severe approach than the Regulation by extending the regime to the "collection" of data for the purposes of profiling. On the other hand, it is less draconian than Albrecht by not applying the regime unless profiling "significantly affects" individuals.
Aside from figuring out what "significantly affects" may mean, which could have academics, lawyers and regulators debating it for life, the most challenging aspect of the Working Party's advice is their call for explicit consent and data minimisation. These would be real practical challenges given the omnipresent and evolving nature of profiling and I wonder whether they are fully justifiable from a public policy perspective.
In order to answer that question, it is crucial to pin down what the risks of profiling are. As with so many other privacy-related topics, profiling as an activity seems to have a rather emotional slant to it - mainly negative. That is an issue because regulatory decisions should be free from that kind of interference. Therefore, it would be wise to take advantage of the year or so that remains before the draft Regulation becomes law to get this matter right, so that real risks are properly tackled whilst the value of data - not just commercial, but societal as well - is preserved and maximised.
The Working Party appears to sit somewhere in the middle between the Commission's proposal and Albrecht's approach. That is still a very strict position to adopt, clearly aimed at eliminating the perceived risks of profiling (although such risks are not identified in the paper).
On the one hand, the Working Party's advice takes a more severe approach than the Regulation by extending the regime to the "collection" of data for the purposes of profiling. On the other hand, it is less draconian than Albrecht by not applying the regime unless profiling "significantly affects" individuals.
Aside from figuring out what "significantly affects" may mean, which could have academics, lawyers and regulators debating it for life, the most challenging aspect of the Working Party's advice is their call for explicit consent and data minimisation. These would be real practical challenges given the omnipresent and evolving nature of profiling and I wonder whether they are fully justifiable from a public policy perspective.
In order to answer that question, it is crucial to pin down what the risks of profiling are. As with so many other privacy-related topics, profiling as an activity seems to have a rather emotional slant to it - mainly negative. That is an issue because regulatory decisions should be free from that kind of interference. Therefore, it would be wise to take advantage of the year or so that remains before the draft Regulation becomes law to get this matter right, so that real risks are properly tackled whilst the value of data - not just commercial, but societal as well - is preserved and maximised.