Academia.eduAcademia.edu

Outline

The impact of profiling on fundamental rights

2013

Abstract

Profiling is a highly evocative term with multiple meanings, used in both specialist and non-specialist contexts. Drawing attention to the innovative feature of profiling as a form of non-representational, probabilistic knowledge, this paper focuses on machine profiling. It aims to elaborate a suitable definition that captures the main features of this new form of generating and applying knowledge. The paper is divided in four parts. Part one explores the distinctive elements of profiling. It discusses some existing concepts and distinctions (such as the meaning of organic, human and machine profiling; non-automated and autonomic profiling; group and individual profiling; direct and indirect profiling) and it provides basic information on Knowledge Discovery in Databases and data mining, as key enablers of profiling. It also presents the most relevant sources of profiling, such as behavioural, biometric and location data. Part two discusses the EU legal framework, including the present discussions on the proposed data protection Regulation and Directive, together with relevant recommendations of the Council of Europe to highlight how profiling is defined and conceptualised in the fields of data protection and anti-discrimination. Part three gives an overview of different domains of application, including the security, law enforcement and counter-terrorism domain, the financial sector, healthcare, employment, marketing, and social media. In the final part, the paper develops a definition of profiling. Building on the work of Mireille Hildebrandt, and taking into account insights from the conceptualisation of profiling in other academic literature, law and policy, and from the application areas, the following definitions are proposed of profiling and related concepts. Profiling is a technique to automatically process personal and non-personal data, aimed at developing predictive knowledge from the data in the form of constructing profiles that can subsequently be applied as a basis for decision-making. A profile is a set of correlated data that represents a (human or non-human, individual or group) subject. Constructing profiles is the process of discovering unexpected patterns between data in large data sets that can be used to create profiles. Applying profiles is the process of identifying and representing a specific subject or to identify a subject as a member of a specific group or category and taking some form of decision based on this identification and representation.

References (54)

  1. to: Rotaru v. Romania (2000), find a summary of the judgment at: http://hudoc.echr.coe.int/sites/eng/pages/search.aspx?i=001-58586#{%22itemid%22:[%22001- 58586%22]} 28 INEX project: http://www.inexproject.eu/index.php The Policy Briefs were developed within WP2 by Gloria González Fuster, Paul de Hert, Erika Ellyne and Serge Gutwirth. References
  2. Benetton A. (2013), Redditometro il ricorso va a segno, in The Fielder, 11 March. Available at: http://thefielder.net/11/03/2013/redditometro-il-ricorso-va-a- segno/#.UlVIPFNo99R
  3. Bonnici J.P.M. (2013), Exploring the non-absolute nature of the right to data protection, in International Review of Law, Computers & Technology, Vol. 27, n.
  4. Bygrave L. A. (2001), Minding the Machine: Article 15 of the EC Data Protection Directive and Automated Profiling, in Privacy Law & Policy Reporter, 2000, volume 7, pp. 67-76. Available at: http://folk.uio.no/lee/oldpage/articles/Minding_machine.pdf
  5. Brause R., Langsdorf T., Hepp M. (1999), Neural Data Mining for Credit Card Fraud Detection, in Proceedings of the 11th IEEE International Conference on Tools with Artificial Intelligence, p. 103, IEEE Computer Society Washington, DC
  6. Canhoto A. (2005), Anti-money laundering profiling, in FIDIS project -Future of Identity in the Information Society, Deliverable 7.2, Descriptive analysis and inventory of profiling practices, pp. 57-58. Available at: http://www.fidis.net/resources/fidis-deliverables/profiling/#c1764
  7. Centerstone Research Institute (2010), A Model of Health, IBM, November. Available at: ftp://public.dhe.ibm.com/common/ssi/ecm/en/ytc03158usen/YTC03158USEN.PD F Citron, Danielle Keats (2007), Technological Due Process. Washington University Law Review, Vol. 85, pp. 1249-1313.
  8. Clarke R. (1994), The Digital Persona and its Application to Data Surveillance, in The Information Society, vol. 10, no. 2. Available at: http://www.anu.edu.au/people/Roger.Clarke/DV/DigPersona.html Committee on Technical and Privacy Dimensions of Information for Terrorism Prevention and Other National Goals, National Research Council, Protecting individual Privacy in the Struggle against terrorists. A Framework for Program assessment
  9. Custers B., Calders T., Schermer B., Zarsky T. (Eds.) (2013), Discrimination and Privacy in the Information Society. Data Mining and Profiling in Large Databases, in Springer-Verlag Berlin Heidelberg Della Mea V., What is e-Health: The death of telemedicine?, in Journal of Medical Internet Research, 3(2):e22. Available at: http://www.jmir.org/2001/2/e22/ ECHR CaseLaw, Case of Amman v. Switzerland, 16 February 2000. Available at: http://echr.ketse.com/doc/27798.95-en-20000216/view/ Electronic Frontier Foundation (2009), Report on the Investigative Data Warehouse, April. Available at: https://www.eff.org/issues/foia/investigative-data- warehouse-report
  10. Ellis, R. K. (2009), Field Guide to Learning Management System, ASTD Learning Circuits European Court of Human Rights, Case of Rotaru v. Romania, 4 May 2000, available at: http://hudoc.echr.coe.int/sites/eng/pages/search.aspx?i=001- 58586#{%22itemid%22:[%22001-58586%22]} European Union Agency for Fundamental Rights (FRA) (2011), Handbook on European non-discrimination law: Case-law update. July 2010 -December 2011, available at: http://fra.europa.eu/sites/default/files/2013-fra-case-law-handbook- update_corr.pdf
  11. Ferraris V., Bosco F., Cafiero G., D'Angelo E., Suloyeva Y. (2013), Defining Profiling, Working Paper 1 of the Profiling project. Available at: http://www.unicri.it/special_topics/citizen_profiling/PROFILINGproject_WS1_defin ition_0208.pdf
  12. Finn R L., Wright D., Friedewald M. (2013), Seven Types of Privacy, in S. Gutwirth, R. Leenes, P. de Hert, Y. Poullet (eds.) European Data Protection: Coming of Age, pp. 3-32
  13. Fuster G., Gutwirth S., Ellyne E. (2010), Profiling in the European Union: a high- risk practice, in INEX Policy Brief, n.10
  14. Gellert R., de Vries K., de Hert P., Gutwirth P. (2013), A Comparative Analysis of Anti-Discrimination and Data Protection Legislations, in Custers B., Calders T., Schermer B., Zarsky T. (Eds.), Discrimination and Privacy in the Information Society. Data Mining and Profiling in Large Databases, Springer-Verlag Berlin Heidelberg, pp. 61-89
  15. Goody J. (1997), Representations and contradictions: ambivalence towards images, theatre, fiction, relics and sexuality, Blackwell, Oxford
  16. Greenlaf G., The influence of European data privacy standards outside Europe: Implications for globalisation of Convention 108?, Research Paper Series, n.2012/12, University of Edinburgh, School of Law Guagnin D., Hempel L., Jung J. (2013), Evolution of Technologies in Profiling, Working Paper 2 of the Profiling project. Available at: http://profiling- project.eu/wp-content/uploads/2013/08/Evolution-of-Technologies-in-Profiling- 08_08.pdf
  17. Gutwirth S., de Hert P. (2008), Regulating profiling in a Democratic Constitutional State, in Hildebrandt, M. Gutwirth S. (Eds.), Profiling the European Citizens, Cross-Disciplinary Perspectives, Springer, pp. 272-293
  18. Gutwirth S., Hildebrandt M. (2010), Some Caveats on Profiling in Gutwirth S., Poullet Y., de Hert P. (Eds.), Data protection in a profiled world, Springer, Dordrecht, pp. 31-41
  19. Hildebrandt M. (2008b), Profiling and the rule of law, in Identity in the Information Society, vol.1, no.1, pp. 55-70
  20. Hildebrandt M. (2009a), Technology and the End of Law, in Claes E., Devroe W. Keirsbilck B. (Eds.), Facing the Limits of the Law, pp. 443-465
  21. Hildebrandt M. (2009b), Profiling and AML, in Rannenberg K., Royer D., Deuker A. (Eds), The Future of Identity in the Information Society. Challenges and Opportunities, Springer, Heidelberg, pp. 273-310
  22. Hildebrandt M (2009c), Who is Profiling Who? Invisible Visibility in Gutwirth S., Poullet Y., de Hert P., de Terwangne C., Nouwt S. (Eds.), Reinventing Data Protection?, Springer, Dordrecht, pp. 239-252
  23. ICCS (2009), Knowledge-Rich Data Mining in Financial Risk Detection in Computational Science -ICCS, Lecture Notes in Computer Science, Volume 5545, 2009, pp. 534-542
  24. Koops B., Schellekens M. (2008), Forensics DNA Phenotyping: regulatory Issues, in The Columbia Science and Technology Law Review. Available at: http://www.stlr.org/html/volume9/koops.pdf
  25. Kuner C., Cate F.H., Millard C., Svantesson D.J.B. (2012), The challenge of 'big data' for data protection, Editorial, International Data Privacy Law (2012) 2 (2): pp. 47-49. Available at: http://idpl.oxfordjournals.org/content/2/2/47.extract# Leenes R. (2008), Do they know me? Deconstructing identifiability, University of Ottawa Law and Technology Journal, 4(1)
  26. Meints M. (2005), Employment, in FIDIS project -Future of Identity in the Information Society, D 7.2, Descriptive analysis and inventory of profiling practices, p.57
  27. Moeckli D., Thurman J. (2008), Counter-terrorism data mining: legal analysis and best practices, in DETECTER project -Detection Technologies, Terrorism, Ethics and Human Rights, Deliverable 8.03
  28. Möller J., Florax B.J. (2002), Kreditwirtschaftliche Scoringverfahren, in Multimedia und Recht (12), pp. 806-811
  29. Nabeth T. (2005), E-learning, in FIDIS project -Future of Identity in the Information Society, D 7.2, Descriptive analysis and inventory of profiling practices pp. 61-63.
  30. OECD (1980), Guidelines on the Protection of Privacy and Transborder Flows of Personal Data. Available at: http://www.oecd.org/sti/ieconomy/oecdguidelinesontheprotectionofprivacyandtran sborderflowsofpersonaldata.htm OECD (2013), The OECD Privacy Framework, including the revised Guidelines on the Protection of Privacy and Transborder Flows of Personal Data, available at: http://www.oecd.org/sti/ieconomy/oecd_privacy_framework.pdf
  31. Ohm P. (2010), Broken Promises of Privacy: Responding to the Surprising Failure of Anonymization, UCLA Law Review, Vol. 57, p.1701
  32. Özden M. (2011), The Right to non-discrimination, in Series of the Human Rights Programme of the CETIM
  33. Pedreschi D., Ruggieri S., Turini F. (2013), The Discovery of Discrimination, in Custers B., Calders T., Schermer B., Zarsky T. (Eds.), Discrimination and Privacy in the Information Society. Data Mining and Profiling in Large Databases, Springer-Verlag Berlin Heidelberg, pp. 91-108.
  34. Pfitzmann A., Köhntopp M. (2009), Anonymity, Unobservability, and Pseudonymity -A Proposal for Terminology, Designing Privacy Enhancing Technologies Lecture Notes in Computer Science Volume 2009, 2001, pp. 1-9
  35. Privacy International (2003), Legal assessment of Communications Data Retention -A violation of the European Convention of Human Rights, 9
  36. Rodotà S. (2009), Data Protection as a Fundamental Right, in Gutwirth S., Poullet Y., De Hert P., Terwangne C., Nouwt S. (2009), Reinventing Data Protection?, Springer
  37. Romei A., Ruggieri S. (2013), Discrimination Data Analysis: A Multi-disciplinary Bibliography, in Custers B., Calders T., Schermer B., Zarsky T. (Eds.) (2013), Discrimination and Privacy in the Information Society. Data Mining and Profiling in Large Databases, in Springer-Verlag Berlin Heidelberg, pp. 109-135
  38. Roosendaal A. (2010), Digital Personae and Profiles as Representations of Individuals, in Bezzi M., Duquenoy P., Fischer-Hubner S., Hansen M., Zhang G. (Eds.), Privacy and Identity Management for Life. 5th IFIP, WG 9.2, 9.6/11.7, 11.4, 11.6, Prime Life International Summer School Nice, France, September 7- 11, 2009, pp. 226-236
  39. Roosendaal A. (2013), Digital Personae and Profiles in Law. Protecting Individuals' Rights in Online Contexts, Wolf Legal Publishers, Oisterwijk Rouvroy A. & Poullet Y. (2009), The right to informational self-determination and the value of self-development. Reassessing the importance of privacy for democracy, in Gutwirth S., Poullet Y., de Hert P., de Terwangne C., Nouwt S. (Eds.), Reinventing Data Protection?, Springer, Dordrecht, p. 45-76
  40. Schermer B. (2013), Risks of profiling and the limits of data protection law, in B. Custers B., Calders T., Schermer B., Zarsky T. (Eds.) (2013), Discrimination and Privacy in the Information Society. Data Mining and Profiling in Large Databases, in Springer-Verlag Berlin Heidelberg, pp. 137-154
  41. Solove D.J. (2004), Digital Person: Technology and Privacy in the Information Age, New York University Press, New York.
  42. Solove D.J. (2007), 'I've Got Nothing to Hide' and Other Misunderstandings of Privacy, San Diego Law Review, Vol. 44, p.745
  43. Steinbock D.J. (2005), Data Matching, Data Mining and due process, in Georgia Law Review, vol. 40, no. 1, pp. 1-84
  44. The Guardian, World News, Edward Snowen. The NSA files. Available at: http://www.theguardian.com/world/edward-snowden
  45. Trudel P. (2009), Privacy Protection on the Internet: Risk Management and Networked Normativity, in Gutwirth S., Poullet Y., de Hert P., de Terwangne C., Nouwt S. (Eds.), Reinventing Data Protection?, Springer, Dordrecht, pp. 317- 334.
  46. Yi P., Gang K.,Yong S. (2009), Knowledge-Rich Data Mining in Financial Risk Detection WHO (2012), Legal frameworks for e-Health, Global Observatory for e-Health series -volume 5. Available at: http://whqlibdoc.who.int/publications/2012/9789241503143_eng.pdf
  47. Zakaria F. (1997), The rise of illiberal democracy, in Foreign Affairs, vol. 76, no. 6, pp. 22-43 Legal texts Article 29 Data Protection Working Party, Working Party on Police and Justice, The Future of Privacy, Joint contribution to the Consultation of the European Commission on the legal framework for the fundamental right to protection of personal data, Adopted on 01 December 2009 Article 29 Data Protection Working Party, Working Party on Police and Justice, Joint opinion on the proposal for a Council Framework Decision on the use of Passenger Name Record (PNR) for law enforcement purposes, presented by the Commission on 6 November 2007, Adopted on 5 December 2007 by the Art. 29
  48. Working Party, Adopted on 18 December 2007 by the Working Party on Police and Justice Article 36 Committee, I/A Item Note to COREPR/ Council, 11858/3/02 REV 3 (Annex), 18.11.2002
  49. Council of Europe, Explanatory Report to the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, ETS n. 108. Available at: http://conventions.coe.int/Treaty/en/Reports/Html/108.htm Council of Europe (1950), European Convention for the Protection of Human Rights and Fundamental Freedoms, as amended by Protocols Nos. 11 and 14, 4 November, ETS 5. Available at: http://www.unhcr.org/refworld/docid/3ae6b3b04.html Council of Europe (2000), Protocol No. 12 to the Convention for the Protection of Human Rights and Fundamental Freedoms, 2000, available at: http://conventions.coe.int/Treaty/en/Treaties/Html/177.htm Council of Europe (2008a), Application of Convention 108 to the profiling mechanism. Available at: http://www.coe.int/t/dghl/standardsetting/dataprotection/Reports/CRID_Profiling_ 2008_en.pdf Council of Europe (2008b), Consultative Committee of the Convention for the protection of Individuals in regard of Automatic Processing of Personal Data, Application of Convention 108 to the Profiling mechanism, Some ideas for the future work of the Consultative Committee (T-PD), 11 January 2008
  50. Council of Europe (2012), The consultative committee of the convention for the protection of individuals with regard to automatic processing of personal data [ETS No. 108], Modernisation of Convention 108: new proposals, DG I Rule of Law and Human Rights Council Framework Decision 2008/977/JHA on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters, 27 November 2008. Available at: http://eur- lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2008:350:0060:0071:en:PDF Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, OJ L 281 , 23/11/1995 P. 0031 - 0050 Directive 2000/43/EC of 29 June 2000, implementing the principle of equal treatment between persons irrespective of racial or ethnic origin, Official Journal L 180 , 19/07/2000 P. 0022 -0026
  51. Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) Directive 2005/60/EC of the European Parliament and of the Council of 26 October 2005 on the prevention of the use of the financial system for the purpose of money laundering and terrorist financing Directive 2006/24/EC of the European Parliament and of the Council of 15 March 2006 on the retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks and amending Directive 2002/58/EC Directive 2009/136/EC of the European Parliament and of the Council of 25 November 2009 amending Directive 2002/22/EC on universal service and users' rights relating to electronic communications networks and services, Directive 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector and Regulation (EC) N. 2006/2004 on cooperation between national authorities responsible for the enforcement of consumer protection laws European Commission (2012) Proposal for a Regulation of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), Brussels, 25.1.2012 COM(2012) 11 final 2012/0011 (COD). Available at: http://ec.europa.eu/justice/data- protection/document/review2012/com_2012_11_en.pdf European Committee on Legal Co-operation (CDCJ), (2010), Recommendation CM/Rec(2010)13 of the Committee of Ministers to member states on the protection of individuals with regard to automatic processing of personal data in the context of profiling available at: https://wcd.coe.int/ViewDoc.jsp?id=1710949&Site=CM
  52. European Parliament, DRAFT REPORT, with a proposal for a European Parliament recommendation to the Council on the problem of profiling, notably on the basis of ethnicity and race, in counter-terrorism, law enforcement, immigration, customs and border control (2008/2020(INI)), Committee on Civil Liberties, Justice and Home Affairs, Rapporteur: Sarah Ludford.
  53. European Union, Charter of Fundamental Rights of the European Union, 7
  54. December 2000, Official Journal of the European Communities, 18 December 2000 (OJ C 364/01). Available at: http://www.unhcr.org/refworld/docid/3ae6b3b70.html