Profiling
Definition
Any automated processing of personal data to evaluate personal aspects of an individual, in particular to analyse or predict performance, finances, health, preferences, behaviour, location or movements.
Profiling is defined in GDPR Art. 4(4) and is at the heart of most AI applied to people: credit scoring, fraud detection, targeted advertising, churn prediction and recommendation engines all evaluate or predict personal aspects. Profiling is not prohibited, but it is regulated in several ways. Individuals have an absolute right to object to profiling for direct marketing and a qualified right to object when it relies on legitimate interest or public task (Art. 21). When profiling leads to solely automated decisions with significant effects, Art. 22 applies, and large-scale systematic profiling usually requires a DPIA.
The LGPD does not define profiling in the same terms but covers it in several provisions: data used to build behavioural profiles of an identified person may be treated as personal data even when anonymized (Art. 12, §2), and Art. 20 allows review of automated decisions that define personal, professional, consumer or credit profiles.
Profiling also carries bias risk, because inferences can reproduce historical discrimination. Transparency about the logic and regular fairness testing are expected safeguards.
Where this term is assessed
Assessed in the Data Protection & AI Professional (DPAI), domain 6: Privacy in AI and analytics.
Also covered in: Responsible AI Practitioner (RAIP)
Primary sources
- GDPR Art. 4(4) and Art. 21
- LGPD Art. 12, §2 and Art. 20