Title: LEGAL IMPLICATIONS OF FORENSIC PROFILING: OF GOOD OLD DATA PROTECTION LEGISLATION AND NOVEL LEGAL SAFEGUARDS FOR DUE PROCESSING.

Legal implications of forensic profiling: of good old data protection legislation and novel legal safeguards for due processing.

Fanny Coudert (ICRI, Katholieke Universiteit Leuven) and Katja de Vries (Vrije Universiteit Brussel), Jacek Kowalewski (Katholieke Universiteit Leuven) 

Human rights are not simple timeless pre-givens. A famous example hereof is the right to privacy – defined as the right “to be let alone” – which emerged in the late nineteenth century in the light of new technologies like “instantaneous photographs and newspaper enterprise” . Thus, sometimes new technologies may create a need for the protection of new rights.  

In the last decades, computing power has increased enormously. At the same time several structural changes have occurred within the law enforcement field: organised crime has become an issue of international concern; police does not hold only data about the people they suspect of having committed a criminal offence but also about the average citizen; criminal intelligence files have evolved so as to take a significant place in law enforcement policies; and finally, databases are interconnected so the information and intelligence does not remain separate from the criminal records anymore . Thus, forensic profiling technologies are today no longer limited to the classical retrospective linkage of one particular trace (e.g. a fingerprint) with one particular suspect – as it has become possible on the one hand to interconnect and compare extensive databases in order to find evidence about crimes and, on the other hand, to apply data mining and risk profiling techniques in order to detect abnormal patterns with crime prevention purposes. As a result of the interconnection of databases both the classical retrospective (solving crimes which have already taken place) as well as the new prospective outlook of forensic profiling (preventing crimes which might take place) have seriously expanded their scope: pointing out to persons who otherwise might have been completely unsuspected.

Data protection laws ensure a series of safeguards to limit the expansion of police powers with regard to the processing of personal data which could cause harmful consequences on the rights and freedoms of individuals. However, the aforementioned changes in the main structure of law enforcement techniques and tools have highlighted insufficiencies in the protection brought by data protection legislations and forces present day lawyers and politicians to rethink if these laws are sufficiently resilient to answer these new technological challenges. In that sense, Commissioner Frattini recalled that “The protection of fundamental human rights such as privacy and data protection stands side-by-side public safety and security. This situation is not static. It changes, and both values are able to progress in step with technological advances. But it also means that there must be lines which cannot be crossed, to protect people’s privacy” . 

This chapter will examine the new threats posed by the use of profiling techniques to fundamental freedoms and the current answers provided by data protection laws, pointing out their insufficiencies. The first two sections provide a general overview of forensic profiling (section ) and the existing legislation with respect to data protection (section ). After these introductory sections the problems for constitutional democracy posed by two new aspects of forensic profiling technology – the interconnection of databases and risk profiling – are analysed more in-depth. Section focuses on the interconnection of databases and its legal implications, while the following two sections provide an analysis of risk profiling: section exploring the insufficiencies in the existing legal instruments with respect to risk profiling and section presenting some suggestions for alternative legal safeguards. It is shown how these alternative data protection safeguards (‘due processing’ and adequate remedies) could play a twofold role in protecting individuals’ freedoms: before the decision-making takes place, the integrity of the data and the strict respect of the purpose principle will guarantee the accuracy and legitimacy of the processing; once the decision has been made on the basis of the profile, the data subject should be protected from harmful consequences through a strict application of the principle of transparency and adequate mechanisms of redress. To conclude with, some concluding remarks are made about data protection with respect to the interconnectivity of databases and risk profiling.