Big Data and Profiling

Processing large data quantities: big data and profiling

In the ongoing discussion about digitalisation and industry 4.0, “big data” is frequently mentioned. Big-data-based applications are able to collect, save and process vast and extensive databases. Companies can, for instance, increase the efficiency of their business processes or communication with customers based on the evaluation of such data. Such datasets can also be used for what is referred to as automated decision-making, which enables companies to take certain decisions with regard to data subjects. Profiling, which is used to assess personal aspects of a natural person, is also a type of automated decision-making. By making us of profiling measures, features such as individual preferences, interests or location data are being analyzed and the results are consulted when making a decision, e.g. on a pay raise.

In the context of big data and profiling, you should keep in mind that they are also subject to the stipulations of the GDPR (e.g. data minimisation, purpose limitation and the general prohibition to process data unless a permission has been explicitly given). Moreover, special rules apply in the case of automated decision-making: they hold that the data subject (e.g. the employee) has the right not to be subject to a fully automated decision. This applies, if the decision becomes legally effective or has detrimental effects for the individual concerned. An online recruiting process without any human intervention is an example for such a case. It follows that human intervention is a necessity in almost all situations. Exceptions to the requirement of human intervention apply when automated decision-making is necessary to enter into a contract or fulfil its terms or when the data subject has given his or her consent.

In practical terms, this means that your company should give due consideration to the question whether or not to use personal data for big data analyses, particularly for profiling, to start with. Yet many companies only notice that they are using data for such purposes when they are already processing them to this end. In such a case, the utilisation of an adequate pseudonymisation process might be a solution.