Mireille Hildebrandt

Profiling the European Citizen

In the eyes of many, one of the most challenging problems of the information society is that we are faced with an ever expanding mass of information. Selection of the relevant bits of information seems to become more important than the retrieval of data as such: the information is all out there, but what it means and how we should act on it may be one of the big questions of the 21st century. If an information society is a society with an exponential proliferation of data, a knowledge society must be the one that has learned how to cope with this. Profiling technologies seem to be one of the most promising technological means to create order in the chaos of proliferating data. In this volume a multi-focal view will be developed to focus upon what profiling is, where it is applied and what may be the impact on democracy and rule of law. The book is the result of research conducted within the framework of the FIDIS (Future of Identity of Information Society) NoE (Network of Excellence).

Profiling: From data to knowledge: The challenges of a crucial technology

Profiling is not about data but about knowledge. It provides a crucial technology in a society that is flooded with noise and information. Profiling is another term for sophisticated pattern recognition, and the enabling technology for Ambient Intelligence. It confronts us with a new type of inductive knowledge, inferred by means of automated algorithms. To the extent that decisions that impact our lives are based on such knowledge, we need to develop the means to make this knowledge accessible for individual citizens and provide them with the legal and technological tools to anticipate and contest such knowledge or challenge its application.

Smart Technologies and the End(s) of Law

Contents: 1. Introduction 2. Smartness and Agency 3. The Onlife World 4. The Digital Unconscious: Back to Diana 5. Threats to Fundamental Rights in the Onlife World 6. The Other Side of Privacy: Agency and Privacy in Japan 7. The Ends of Law: Address and Redress 8. Intricate Entanglements of Law and Technology 9. The Fundamental Right of Data Protection 10. The End of Law or Legal Protection by Design 11. References Index

Who is Profiling Who? Invisible Visibility

The assumption of the conference on ‘Reinventing Data Protection?’ was that data protection and privacy are not the same thing, though they may overlap. One of the questions raised by advanced data processing techniques like data mining and profiling is whether the assumption that it is data that need to be protected still holds.1 The data protection directive of 1995 builds on the concept of personal data, defined as data that relate to an identified or identifiable natural person.2 When looking into the consequences of extensive profiling – the precondition for e.g., Ambient Intelligence and other smart applications – we may come to the conclusion that the difference

Some Caveats on Profiling

In this chapter we endeavor to expose the singularity of profiling techniques, data mining or knowledge discovery in databases. Pursuant to this, we point at a number of caveats that are linked to the specifics of profiling. Those caveats pertain to issues related to dependence, privacy, data protection, fairness (non-discrimination), due process, auditability and transparency of the profilers and knowledge asymmetries. This chapter reiterates and builds further upon some of the findings of our research on profiling we presented in a volume we co-edited: Profiling the European Citizen. Cross-disciplinary Perspectives, which brought together leading experts in the domains of compute science, law and philosophy. We thank these authors, members of the ED funded consortium on the Future of Identity in the Information Society (FIDIS), for their joint effort to compose a handbook on a subject that is mostly discussed from singular disciplinary perspective.

Legal protection by design: objections and refutations

Abstract To cope with an increasingly proactive technological infrastructure a so-called vision of Ambient Law has been developed. It entails the articulation of legal protection into the ICT architecture, to safeguard our rights and freedoms within the various cyberspaces we inhabit. I will argue that the Internet of Things and Ambient Intelligence generate novel challenges to the rights to privacy, due process and non-discrimination, warranting effective remedies beyond the written law. The vision of Ambient Law builds on similar notions within the domain of ethics of technology (e.g. privacy by design, privacy by default, value-sensitive design). Expanding on previous publications this contribution engages with three possible objections to the idea of legal protection by design. Firstly, one could object that legal protection should be technology-neutral, meaning that regulators should avoid technology dependence when formulating legal norms. This could imply that legal protection cannot be part of a technological design. Second, one might equate this approach with taking a command-and-control perspective, assuming that the intervention of the democratic legislator engages a top down perspective, compared to e.g. public-private collaboration. Third, one might equate the idea of Ambient Law with techno-regulation, or technological enforcement of administrative law. I will argue that all three objections misconstrue the notion of Ambient Law, and miss the point that law-as-we-know-it is already technologically embodied. The conclusion will be that when we move from the technologies of the script to those of mobile interconnected digital computer systems, effective legal protection requires creative re-enactment into the novel infrastructures.

Profiling and AmI

Some of the most critical challenges for ‘the future of identity in the information society’ must be located in the domain of automated profiling practices. Profiling technologies enable the construction and application of group profiles used for targeted advertising, anti-money laundering, actuarial justice, etc. Profiling is also the conditio sine qua non for the realisation of the vision of Ambient Intelligence. Though automated profiling seems to provide the only viable answer for the increasing information overload and though it seems to be a promising tool for the selection of relevant and useful information, its invisible nature and pervasive character may affect core principles of democracy and the rule of law, especially privacy and non-discrimination. In response to these challenges we suggest novel types of protection next to the existing data protection regimes. Instead of focusing on the protection of personal data, these novel tools focus on the protection against invisible or unjustified profiling. Finally, we develop the idea of Ambient Law, advocating a framework of technologically embedded legal rules that guarantee a transparency of profiles that should allow European citizens to decide which of their data they want to hide, when and in which context.

Cogitas, Ergo Sum. The Role of Data Protection Law and Non-discrimination Law in Group Profiling in the Private Sector

This chapter focuses on the legal uncertainty regarding the applicability of data protection law in the case of profiling. This legal uncertainty stems amongst others from the definitions of personal data, data processing and data controller in EU regulations as well as from the possible exclusion of anonymous data from the applicability of data protection law. We will show that it is perfectly possible to construct and apply profiles without identifying the person concerned in the sense of data protection law. We will build our legal analysis gradually upon the three different steps that exist in the construction and application of profiles: the collection of personal data and other information to construct the profile; the construction of the profile upon personal and anonymous data and the application of a group profile to a group or an individual. For each level, we will analyse whether and how data protection law applies. We will use case law and legal doctrine in our analysis. As a result of the legal uncertainty that we find in data protection law, we will then try to find answers in privacy and anti-discrimination law, with a special focus on legislation and jurisprudence in the case of racial and ethnic profiling.

Law as Information in the Era of Data-Driven Agency

This contribution introduces the mathematical theory of information that ‘informs’ computer systems, the internet and all that has been built upon it. The aim of the author is to invite lawyers to reconsider the grammar and alphabet of modern positive law and of the Rule of Law, in the face of the alternative grammar and alphabet of a data‐driven society. Instead of either embracing or rejecting the technological transitions that reconfigure the operations of the law, this article argues that lawyers should collaborate with the computer scientists that engineer and design the affordances of our new onlife world. This is crucial if we want to sustain democratic participation in law‐making, contestability of legal effect and transparency of how citizens may be manipulated by the invisible computational backbone of our rapidly and radically changing world.

Ethical Implications of ICT Implants

This chapter focuses on a variety of ethical implications of ICT implants. We will explain how different ethical implications arise from different types of implants, depending on the context in which they are used. After a first assessment of what is at stake, we will briefly discuss the Opinion 20 of the European Group on Ethics of Science and New Technologies as published in 2005. We will extend the scope of discussion by tracing the ethical implications for democracy and the Rule of Law, considering the use of implants for the repair as well as the enhancement of human capabilities. Finally, we will refer to a set of EU research projects that investigate the relevant ethical implications.