This article is also available in:
Deutsch: ENDitorial: Empfehlung des Europarats zu Profiling

Approximately in parallel to the work of the EU's Article 29 Committee on cookies, the Council of Europe has been preparing a wider Recommendation on profiling. The document has been discussed for over a year, with a consultation on an earlier draft having been organised at the end of 2009.

While obviously responding to the increasing options offered by the digital environment with regard to public and private sector profiling, the text attempts to cover the online and offline environments. The document makes some pertinent statements - in addition to acknowledging the positive benefits of more targeted services, it points out that "the lack of transparency or even "invisibility" of profiling and the lack of accuracy that may derive from the automatic application of pre-established rules of inference can pose significant risks for the individual's rights and freedoms," that "violate the principle of non-discrimination" and that profiling could expose individuals to particularly high risks of discrimination and attacks on their personal rights and dignity. However, it then does little to mitigate these risk and, worse still, appears to increase the chances of such risks being taken with personal data by public authorities.

The text copies and pastes definitions from the Convention on Data Protection which seem rather incongruous in this context in the absence of more detailed analysis and practical analysis. From the profiling organisation's perspective, it seems obvious that data should and will be "adequate, relevant and not excessive in relation to the purposes for which they are collected or for which they will be processed". Generally, however, a lot of questions are left open, such as what could be understood by "informed consent", procedures for providing access to and correction of data which is indirectly personally identifiable.

Overall, the current draft text does little to clarify the core issues of effective communication to consumers, informed consent, access to and correction of data and the "right to be forgotten". Earlier drafts of the proposal were neutral on the use of profiling by states, indicating that the Recommendation was aimed at the private sector, leaving the choice to Member States to extend it to the public sector if they so wished. This was replaced in the most recent version, which seems to assume the use of profiling by state authorities and implicitly accepts that, when "necessary".

Member States can both use profiling and avoid implementation of a large swathe of the Recommendation covering lawfulness, information and the rights of data subjects. Bearing in mind the dangers to fundamental rights identified and enumerated in the text and previous positions taken by the Council of Europe, it appears unlikely that implicit and uncritical support for profiling is the intention of the Recommendation.

Draft Recommendation on the Protection of Individuals with regard to automatic processing of personal data in the framework of profiling June 2010 (3.06.2010)
http://www.coe.int/t/e/legal_affairs/legal_co-operation/steering_commi...

Draft Recommendation on the Protection of Individuals with regard to automatic processing of personal data in the framework of profiling (2.10.2009)
http://www.coe.int/t/e/legal_affairs/legal_co-operation/data_protectio...

EDRi Consultation Response (3.11.2009)
http://www.edri.org/docs/edri_CoEprofiling_response_091103.pdf

(Contribution by Joe McNamee - EDRi)