GDPR profiling clampdown puts companies on red alert

Companies still struggling to get to grips with the new rules governing marketing consent under GDPR might want to look away now after the Information Commissioner’s Office revealed plans to tighten up the use of profiling which could make the technique virtually impossible to use.
Earlier this week, the ICO published a discussion paper highlighting the key areas of profiling it feels need further consideration, including for marketing, and is calling for submissions before April 28.
Interestingly, unlike with consent, the ICO has not issued its own guidance yet but is calling on companies which already use profiling services to provide feedback as to how the new laws will affect their business.
The prospective guidelines, particularly a possible explicit consent requirement, will have a huge impact on how advertisers and those online services that provide consumer recommendations, structure their business models.
The GDPR requires companies which use personal data with a “significant effect” on an individual to get their explicit consent. The question for automated profiling is whether it meets the “significant effect” threshold.
The ICO states: “Profiling technologies are regularly used in marketing. Many organisations believe that advertising does not generally have a significant adverse effect on people. This might not be the case if, for example, the use of profiling in connection with marketing activities leads to unfair discrimination.”
It went on to quote a study conducted by the Ohio State University which revealed that behaviourally targeted ads can have psychological consequences and affect individuals’ self-perception. This can make these ads more effective than ones relying on traditional demographic or psychographic targeting.
It added: “If individuals believe that they receive advertising as a result of their online behaviour, an advert for diet products and gym membership might spur them on to join an exercise class and improve their fitness levels. Conversely it may make them feel that they are unhealthy or need to lose weight. This could potentially lead to feelings of low self-esteem.”
Nicola Cain, legal director at Reynolds Porter Chamberlain LLP in London, told Bloomberg BNA that the regulator seems to be considering a very low threshold for what types of profiling may be considered to have a significant effect on data subjects.
One industry insider said: “Profiling is a massive issue, and the UK, US and EU authorities have all been investigating it now for some time. How the ICO can expect to police such a complex area is anyone’s guess and frankly it is ridiculous to expect this be settled by May next year.”

Share with friends and colleagues

Related Articles