Navigating the Dataverse: Privacy, Technology ... - The ICHRP

Let’s take another example: “risk profiling” by financial institutions. A recent study of the
phenomenon found that banks compile risk profiles not only in order to minimise their
own risks of default, but also to comply with obligations to ensure they are not facilitating
money laundering or terrorism. Indeed, multinationals may be required by their presence
in one jurisdiction to apply certain policies everywhere, so “banks [regardless of location]
that want to do business in the United States have to implement a worldwide Know Your
Customer (KYC) program, partially based on the Patriot Act”. 194
A degree of opacity would appear necessary, in this case, to the evaluation of risk or creditworthiness.
Moreover, the requirement to monitor for money-laundering and fraud may
exempt banks from full disclosure on data held and processed – indeed, when it comes
to terrorism, we again see a destabilising of the public-private divide: “public” (state)
and “private” (banking) institutions share an identical rationale for the non-disclosure of
personal data to the relevant (“private”) individuals. 195 The consequences for the data
subject may be significant. “Although these risk profiles may be lacking reliability, they are
applied to take measures against high risk clients [who] may be put under close scrutiny,
rejected financial services, blacklisted, etc. Clients often have little means of redress as
transparency regarding profiling and its implications is lacking”. 196
Here we find the familiar opacity-transparency dichotomy, but the space restricted from
view in this case does not protect the privacy/autonomy of the individual – it rather
protects the autonomy (the decisional, local and informational privacy) of the relevant
institution. Moreover this relative asymmetry of autonomy appears unavoidable if
institutions (public or private) are to correctly gauge the trustworthiness of the clients they
manage. We are back, then, at the rationale for surveillance outlined at the beginning
of Chapter 3. Informational asymmetry is beginning to look, in these examples, as a
systemic requirement if an information-saturated world is to function according to widely
accepted principles of security.
To end Chapter 5, let us engage in a thought experiment. Suppose the Data Protection
Directive extends to data subjects a right of access to data held about them (subject, as
usual, to certain standard qualifications and exceptions). Suppose also that its provisions
applied to all data held by corporations and governments – including, for the sake of
the experiment, those outside the EU. Would it be possible to assimilate, parse, analyse,
maintain, comprehend, manage the volume of information that would be unearthed on any
given individual? 197 Or to evaluate and suppress non-compliant “data”? Or to “control” the
rest? What would be the necessary conditions for such management? How could it be done
in such a way that any “informational asymmetries” are eliminated? The mind boggles.
Chapter 5 has looked at the legal framework governing an individual’s control over the
information generated about the self. It has noted a number of human rights principles
relevant in this domain: privacy, non-discrimination and data-protection. An investigation
of the relevant legal practice tends to show that existing human rights norms in the
domain of privacy are not equipped or intended to address the anxieties of the dataverse.
Indeed, it is unclear whether they can be articulated in human rights terms at all. The
194 Bart Custers, “D 7.16: Profiling in Financial Institutions”, FIDIS (2009), 10: “In order to track fraud, money laundering
and terrorist funding, financial institutions have a legal obligation to create risk profiles of their clients”.
195 An intriguing question is whether banks might be exempted from disclosing risk profiles held on clients
to them, under the Directive’s Article 13(1)(g) (as the risk profile might arguably be intended to protect
“the data subject or the rights and freedoms of others”) or 13(2) (as the risk profile might present “clearly
no risk of breaching the privacy of the data subject”.)
196 Custers (2009), 8. On this general theme, Nock (1993).
197 For a similar point concerning “consent” in the Directive, Hildebrandt (2005), 45.
Navigating the Dataverse: Privacy, Technology, Human Rights 59