Council of Europe updates Recommendation on profiling to align with Convention 108+

Since the methods and impact of profiling on individuals have radically developed in the last decade, the Committee considered it important to update its 2010 Recommendation, as well as to align its provisions with the so-called modernised Convention 108+ (the protocol that modernises the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (CETS No. 108)).

The Recommendation suggests definitions of certain terms, including “artificial intelligence”, “machine learning processing” and an “automated decision-making system.”  Profiling is defined as “any form of automated processing of personal data, including use of machine learning systems, consisting in the use of data to evaluate certain personal aspects relating to an individual, in particular to analyse or predict aspects concerning that person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.”

The Committee recognised the wide use of the automatic profiling of large amounts of data, the lack of transparency regarding the methods of profiling and the significant risks posed to the rights and freedoms of individuals, particularly where their data is categorised or profiled without their knowledge. As a result, the Recommendation addresses the need for member states to implement additional safeguards to protect the personal data and private lives of individuals.

By way of summary, the Committee recommends that:

• profiling must not result in discrimination against individuals, groups or communities; it should not undermine the dignity of persons or democracy. The use of automated decision-making systems should preserve the autonomy of human intervention in the decision-making process; 
• member states should encourage privacy by design, notably through the use of privacy-enhancing technologies, and take appropriate measures to prevent the development of technologies that are aimed at circumventing privacy protections; and
• where profiling is based on consent, online services should give data subjects the possibility of opting in or out of profiling and choosing between the different profiling purposes or degrees.

Read the press release Data protection: Committee of Ministers updates recommendation on profiling and the Recommendation.