Title: THE SECOND STEP: THE CONSTRUCTION OF (GROUP) PROFILES, INCLUDING MAKING PERSONAL DATA ANONYMOUS

The aim of constructing profiles by means of data mining techniques is to transform data into knowledge. This knowledge can in fact lead to the situation that the profile confronts people with information about themselves they did not know before.

Two situations must be distinguished: the personal data used to construct profiles are rendered anonymous after their collection or they remain related to identified/identifiable persons. 

1. In the first situation, when data are rendered anonymous, data protection legislation may not apply. That would mean that people don not have access to the knowledge of the profiler and can not control the creation of group profiles that can concern them as a member of a group. Non applicability would have as a consequence that, for instance, article 12 of D95/46 EU, that reads that ‘the data subject has the right to obtain from the controller (…) knowledge of the logic involved in any automatic processing of data concerning him at least in the case of the automated decisions referred to in Article 15.1 does not apply’. This is not a desirable situation. When group profiles are applied - even if based on anonymous personal data - they can have major impact on people’s autonomy and self-determination.

2. In the second situation, if personal data are not rendered anonymous, data protection remains applicable. But the question remains whether and how the subject has the right to interfere in this process once the data controller has got the right to process the data for profiling purposes (see above). Control by the data subject exists mainly at the level of data collection. The right to object to processing of personal data for the purpose of direct marketing - although it is not clear what would constitute direct marketing in AmI - exists for example de facto only at the level of the data collection. We here refer to the discussions above. There are, however, some rights that can be invoked particularly at the level of the construction of profiles. They can contribute in an important manner to obtain knowledge of the profiles that incorporate one’s personal data. One such important right can be found in the above- mentioned article 12. In practice, however, it may be difficult to invoke this right. The right to be informed whether or not personal data are being processed, the right to know the categories of data concerned and the right to obtain communication in an intelligible form of the data undergoing processing (article 12), is also of particular relevance in the stadium of profile construction because otherwise the data subject does not know which of the collected personal data concerning him, are finally used to construct the profile. Also the right to be informed who the recipients (or categories of recipients) of the data are (article 12), can be important because the transfer of the profile to third parties occurs often - mainly - after the construction of the database. But this right can only be invoked if necessary to guarantee a fair processing (article 10), which again leaves the door open for discussion. As we have seen, the information of the categories of recipients is too broad and does not give clear indication by whom, where and when the profile will be used and applied. Finally, at this stage also, data subjects have the right to correct data and to object further processing when the controller anticipates personal data being processed for the purposes of direct marketing.

Lastly we should add that natural persons have in principle no (intellectual) property right to their personal data. However, some authors do argue for an intellectual property right in “human identity”. Also Intellectual property rights to personal data may also exist in the case of profiles to the extent that they are in fact collections of personal data in the form of a database. In that case they may enjoy the sui generis intellectual right of the database, when they are the result of a creation or a substantial investment of the maker of the profile. These creations and results are often trade secreted, patented or copyrighted. They are major assets of companies and are object of sharing, selling and licensing. In other words, when personal data are transformed into the correlated set of anonymous data that form a profile, they slip out of the control of the natural person and become property of a company.