What is profiling?

When does personalisation become profiling?

The GDPR defines profiling as automated processing that uses personal data to evaluate personal aspects of a natural person – in particular to analyse or predict work performance, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements. In marketing, examples include affinity and lead scores or predictions of who is likely to cancel.

For direct marketing, the balancing of interests under Art. 6(1)(f) GDPR is often the legal basis. According to the German supervisory authorities, however, intrusive measures – automated selection procedures for creating detailed profiles, behavioural predictions or analyses that lead to additional insights – tend to indicate that the interests of the data subjects prevail; in that case consent is generally required (DSK guidance on direct marketing, February 2022).

Data subjects can object to processing for direct marketing at any time; this also applies to related profiling (Art. 21(2) GDPR). Art. 22 GDPR protects against decisions based solely on automated processing that have legal or similarly significant effects. Where personal aspects are evaluated systematically and extensively, a data protection impact assessment must be considered (Art. 35 GDPR).