Navigating the Dataverse: Privacy, Technology ... - The ICHRP

In the European legal space, standards are introduced to ensure that personal
data are processed smoothly and efficiently and to facilitate their movement
and exchange.
As to its substantive, protections, the Directive expects “data controllers” to provide
“data subjects” with the “categories” of information held on them, but not with the data
itself, unless proactively asked. Even then, delivery (and even notification) is subject to
numerous exemptions. Even where data subjects request, and are delivered, their own
data, they have no right to seek deletion except when those data “do not comply” with the
Directive. In short, the Directive may be an instrument of data protection, but it does not
provide data subjects with effective control over the nature and extent of personal data
collected on them. (And the data are always personal: that, indeed, is the point.) 179
This takes us to profiling. Strictly speaking, personal data protection and profiling
are, again, two sides of a coin. The objective of personal data processing is to create
profiles. 180 This is especially clear when we remember that profiles are best conceived of
as aggregates, rather than as individuals. A profile describes a kind of person, one who
does certain kinds of things, one who represents a certain proportion of the population
in described ways: complexion, talents, illnesses, purchasing proclivities, income
brackets, schooling levels, professional qualifications, socio-economic status, eating
and drinking habits, preferred entertainment, locations, marriage status, and so on.
profile describes a kind of person, one who does certain kinds of things,
A one who represents a certain proportion of the population in described
ways: complexion, talents, illnesses, purchasing proclivities, income brackets,
schooling levels, professional qualifications, socio-economic status, eating and
drinking habits, preferred entertainment, locations, marriage status, and so on.
Profiles are generated when pieces of information are linked together. In the words of
Mireille Hildebrandt, “profiling is knowledge-construction”. 181 It is on the basis of data-rich
profiles that state policy is formulated, and marketing strategies are devised. Just as a
principle of informational asymmetry is built into the etymology of the term “surveillance”
(the single guard monitoring prisoners from on high), so the “profile” is an instrument
of efficiency designed to summarise the complexity of many in a few. It is this form of
profile that provides the “categories” sought by the Strasbourg Court in the Marper
case. Profiling in this sense allows policy to discriminate. The human rights question, as
usually posed, is merely whether such discrimination is on prohibited grounds or not.
Increasingly, however, profiles need not be composed only from aggregates. 182
Individuals can be profiled as such. Cookie-trails are a form of profile, or signature, as
are DNA profiles (the subject of Marper), which also belong to individuals. Just as a
single profile can describe a multitude of persons (e.g., “early adapters”), so a single
179 Personal data is defined in Art. 2(a) as: “any information relating to an identified or identifiable natural
person (‘data subject’); an identifiable person is one who can be identified, directly or indirectly, in
particular by reference to an identification number or to one or more factors specific to his physical,
physiological, mental, economic, cultural or social identity”.
180 Gutwirth and De Hert (2005), 28: “Without collecting and correlating such personal data, no profiling is
thinkable. And that is precisely why, in legal terms, no profiling is thinkable outside data protection”.
181 Mireille Hildebrandt, “Profiling and the Identity of European Citizens” in FIDIS (2005), 29.
182 For a thorough technical account, Mireille Hildebrandt and James Backhouse, “D7.2: Descriptive analysis
and inventory of profiling practices”, FIDIS (2005).
56 Navigating the Dataverse: Privacy, Technology, Human Rights