D7.4: Implications of profiling practices on democracy

Title: A CHANGING LANDSCAPE FOR DEMOCRACY AND THE RULE OF LAW

Profiling technologies open up previously unknown opportunities to correlate data of individual persons and things. The resulting profiles can be used by government, commercial and other organisations to identify people, things or even situations. In addition, they may be used to assess possible opportunities and risks attached to these people, things or situations. As the descriptive analysis of profiling (FIDIS deliverable 7.2) has shown, the proliferation of automatically generated profiles could have a profound impact on a variety of decisions that influence the life of European citizens. At the same time it seems unclear whether and how a person could trace if and when decisions concerning her life are taken on the basis of such profiles.

Profiling is knowledge construction. It produces a new kind of knowledge about groups or individuals. Group profiles are often used to identify persons or to attribute a certain lifestyle, health risks, earning capacity or customer preferences to a person. Even when a group profile does not necessarily apply to the individual members of the group, it may still be used because of the probability that part of the profile does apply. As a result, service providers, insurance companies, forensic agencies, fraud detection departments or agencies and even e-learning organisations use profiling technologies to identify and categorise their target populations. Individual profiles contain personalised knowledge about specific individuals, inferred from off- and online behaviour, registration of birth and/or biometric data. As has been extensively demonstrated in FIDIS deliverable 7.2, the knowledge we are talking about is not merely a set of data, but rather the patterns that have been ‘discovered’ in the data, that provide new knowledge that those concerned may not be aware of. The novelty or the invasiveness of this knowledge does not depend on the sensitive nature of the personal data that have been mined. Sets of correlated data, that would be considered insignificant or even trivial, can provide intimate knowledge about life style, health risks etc.  

The vast expansion of data bases and their content thus make possible a new type of knowledge constructs that may develop into an infrastructure that pervades most aspects of everyday life. If the vision of Ambient Intelligence (AmI) as propagated by the Information Society Technologies Advisory Group (ISTAG) comes through, European citizens will live in networked environments, seamlessly connected with a variety of intelligent electronic devices that follow our movements and behaviour in real time, inferring wishes, desires and preferences. This networked environment will collect an enormous amount of data, that can be correlated via multiple data mining strategies, producing a continuous stream of profiles that can be tested and enhanced to better service those that ‘use’ them. This raises the question of who ‘uses’ these profiles: (1) the European citizen that is receiving personalised services, and/or that can access personalised risk assessments or compare her own preferences with those of groups she is clustered with, or (2) the commercial service providers and government agencies that use profiles to get a better picture of the risks and opportunities concerning consumers, voters, potential criminals, terrorists or victims. Who is in control: (1) the European citizen (the data subject, or end user) or (2) the organisations that invest in profiling technologies (the data user and the data controller, either commercial or governmental)?

In this paper the changing landscape of our networked information society is considered with regard to the architecture of our constitutional democracy. As Gutwirth and De Hert clarified in chapter , the fundamental tenets of a democratic constitutional state are: human rights, the rule of law and sovereignty of the people. Invented and developed as hallmarks of democracy and the rule of law over hundreds of years from the 17th to the 20th century, these tenets, shaped by particular historical circumstances, moulded our social environment into a specific system of checks and balances. To be sustainable into the 21st century the architecture of the democratic constitutional state will have to be reinvented, perhaps even beyond the confines of the state (as the information society can hardly be confined within the borders of a national or even supranational state). This reinvention necessitates awareness of the historical roots of constitutional democracy. In section we shall briefly consider this issue and highlight the central role played by the human person and the legal subject within both democracy and the rule of law. The legal instruments that are usually quoted as protection against invasion or redefinition of the human person are a right to privacy and data protection legislation. In section privacy and data protection will be discussed as legal instruments to protect against invasion or redefinition of the human person, referring to the work of Gutwirth and De Hert on tools of opacity and tools of transparency (see chapter above). A case will be made for the relevance of these tools, and the relationship between privacy and data protection will be analysed in order to clarify some persistent issues concerning the purposes of data protection and of the protection of private life. After that, in section , I will focus on data protection in relation to profiling practices. Autonomy, security, privacy and equality will be discussed as crucial elements of constitutional democracy, to be sustained by – amongst other things – data protection legislation. In section I will discuss the question whether data protection legislation can be effective and consider the merits of integrating legal and technological design in order to establish an infrastructure that can renew and sustain the architecture of democracy and the rule of law.