Profiling

Under Article 4(4) GDPR, profiling means any form of automated processing of personal data that uses those data to evaluate certain personal aspects of a natural person or analyse or predict them. The examples include performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location and movements. The purpose of the system and the way the data are evaluated matter more than the label given to the process.

Profiling is not automatically automated decision-making. A business may create or use a profile without taking a legally binding decision on that basis. Conversely, a solely automated decision under Article 22 GDPR may include profiling. In that situation, the effects on the person, meaningful human involvement and the safeguards required by law need particular attention. For direct marketing, Article 21 GDPR gives data subjects the right to object at any time, including to related profiling.

Businesses should document the purpose, data sources, features, evaluation logic, recipients and effects of profiling in a way that can be explained and reviewed. The topic on marketing, cookies and tracking covers advertising profiles and consent questions. The privacy compliance and governance topic helps organise responsibilities and evidence. Profiling concerning employees should also be reviewed under employee data protection.