What is profiling?
Profiling is automated processing used to evaluate, analyse or predict aspects of a person. It may assess preferences, behaviour, performance, reliability, health, location, financial circumstances or likely actions. Profiling supports activities such as personalisation, risk scoring, fraud detection, advertising, workforce analytics and eligibility decisions.
A profile can be based on information provided directly by the person, observed activity or inferences generated by a model. Inferred data may be uncertain or inaccurate but can still materially affect how a person is treated.
Why does profiling create privacy risk?
Profiling can reveal sensitive characteristics, create unexpected categorisation and influence opportunities without the person understanding the process. Large-scale profiles may be reused across purposes or shared with parties the individual did not anticipate.
Risks increase when profiling supports significant decisions, uses sensitive data, affects vulnerable people or produces outcomes that are difficult to challenge. Bias and inaccurate data can systematically disadvantage groups.
How should profiling be assessed?
Organisations should define the purpose, data sources, logic, outputs, affected groups and role of human decision-makers. They should assess lawful basis, transparency, necessity, accuracy, fairness, data minimisation and retention.
Testing should examine performance across relevant groups and the consequences of false classifications. A privacy or data-protection impact assessment may be appropriate for extensive or high-risk profiling.
What controls reduce profiling risk?
Controls include limiting data and purpose, explaining the use, allowing objection or preference changes where required, applying human review, testing bias, correcting data and monitoring outcomes. Profiles should not be treated as objective facts when they are predictions or probabilities.
Access and sharing should be restricted, and retention should reflect the continuing relevance of the profile. Old profiles can become inaccurate and misleading.
Frequently asked questions
Is customer segmentation profiling?
It can be when automated processing evaluates or predicts characteristics of identifiable individuals, even if the segment is broad.
Is all profiling automated decision-making?
No. Profiling may provide information without making the final decision, although it can materially influence a decision.
Can profiling reveal sensitive data?
Yes. Behaviour and purchases may support inferences about health, beliefs, finances or other sensitive characteristics.
Does a person have a right to object?
Rights depend on the law and lawful basis. Organisations should provide appropriate information and mechanisms where an objection applies.
How often should profiles be updated?
They should be reviewed according to purpose and risk. Inaccurate, outdated or unnecessary profiles should be corrected or deleted.