Cogitas, Ergo Sum. The Role of Data Protection Law and Non-discrimination Law in Group Profiling in the Private Sector

This chapter focuses on the legal uncertainty regarding the applicability of data protection law in the case of profiling. This legal uncertainty stems amongst others from the definitions of personal data, data processing and data controller in EU regulations as well as from the possible exclusion of anonymous data from the applicability of data protection law. We will show that it is perfectly possible to construct and apply profiles without identifying the person concerned in the sense of data protection law. We will build our legal analysis gradually upon the three different steps that exist in the construction and application of profiles: the collection of personal data and other information to construct the profile; the construction of the profile upon personal and anonymous data and the application of a group profile to a group or an individual. For each level, we will analyse whether and how data protection law applies. We will use case law and legal doctrine in our analysis. As a result of the legal uncertainty that we find in data protection law, we will then try to find answers in privacy and anti-discrimination law, with a special focus on legislation and jurisprudence in the case of racial and ethnic profiling.