ENDitorial: Council of Europe draft Recommendation on Profiling

This article is also available in:
Deutsch: [ENDitorial: Empfehlung des Europarats zu Profiling | http://www.unwatched.org/node/2038]

Approximately in parallel to the work of the EU’s Article 29 Committee on
cookies, the Council of Europe has been preparing a wider Recommendation on
profiling. The document has been discussed for over a year, with a
consultation on an earlier draft having been organised at the end of 2009.

While obviously responding to the increasing options offered by the digital
environment with regard to public and private sector profiling, the text
attempts to cover the online and offline environments. The document makes
some pertinent statements – in addition to acknowledging the positive
benefits of more targeted services, it points out that “the lack of
transparency or even “invisibility” of profiling and the lack of accuracy
that may derive from the automatic application of pre-established rules of
inference can pose significant risks for the individual’s rights and
freedoms,” that “violate the principle of non-discrimination” and that
profiling could expose individuals to particularly high risks of
discrimination and attacks on their personal rights and dignity. However, it
then does little to mitigate these risk and, worse still, appears to
increase the chances of such risks being taken with personal data by public
authorities.

The text copies and pastes definitions from the Convention on Data
Protection which seem rather incongruous in this context in the absence of
more detailed analysis and practical analysis. From the profiling
organisation’s perspective, it seems obvious that data should and will be
“adequate, relevant and not excessive in relation to the purposes for which
they are collected or for which they will be processed”. Generally, however,
a lot of questions are left open, such as what could be understood by
“informed consent”, procedures for providing access to and correction of
data which is indirectly personally identifiable.

Overall, the current draft text does little to clarify the core issues of
effective communication to consumers, informed consent, access to and
correction of data and the “right to be forgotten”. Earlier drafts of the
proposal were neutral on the use of profiling by states, indicating that the
Recommendation was aimed at the private sector, leaving the choice to
Member States to extend it to the public sector if they so wished. This was
replaced in the most recent version, which seems to assume the use of
profiling by state authorities and implicitly accepts that, when “necessary”.

Member States can both use profiling and avoid implementation of a large
swathe of the Recommendation covering lawfulness, information
and the rights of data subjects. Bearing in mind the dangers to fundamental
rights identified and enumerated in the text and previous positions taken by
the Council of Europe, it appears unlikely that implicit and uncritical
support for profiling is the intention of the Recommendation.

Draft Recommendation on the Protection of Individuals with regard to
automatic processing of personal data in the framework of profiling June
2010 (3.06.2010)
http://www.coe.int/t/e/legal_affairs/legal_co-operation/steering_committees/cdcj/documents/2010/87th%20CDCJ-BU%20meeting/T-PD-BUR_2009_02rev6_en_Fin%20_2_.pdf

Draft Recommendation on the Protection of Individuals with regard to
automatic processing of personal data in the framework of profiling
(2.10.2009)
http://www.coe.int/t/e/legal_affairs/legal_co-operation/data_protection/events/t-pd_and_t-pd-bur_meetings/2T-PD-BUR_2009_02rev4_en.pdf

EDRi Consultation Response (3.11.2009)
http://www.edri.org/docs/edri_CoEprofiling_response_091103.pdf

(Contribution by Joe McNamee – EDRi)