Data Protection

Automated Profiling

AI-driven analysis of personal data to categorize individuals and predict their behavior without human intervention.

Definition

Automated Profiling refers to profiling conducted entirely or predominantly through automated means, including artificial intelligence and machine learning systems, without significant human intervention in the analysis or prediction process. It represents the intersection of GDPR's profiling provisions and AI regulation.

Regulatory Framework: Automated profiling is regulated under both GDPR (as a form of profiling subject to Article 22) and the EU AI Act (where certain automated profiling systems are classified as high-risk under Annex III).

High-Risk Classifications (EU AI Act Annex III):

  • Employment: Profiling for recruitment, promotion, task allocation
  • Education: Profiling for admission, assessment, or monitoring
  • Credit: Creditworthiness assessment and scoring
  • Insurance: Risk assessment for life and health insurance
  • Public benefits: Eligibility assessment for social services

Enhanced Obligations:

  • GDPR Article 22: Prohibition on solely automated decisions with legal/significant effects (subject to exceptions)
  • AI Act High-Risk: Full Chapter 2 requirements including risk management, data governance, transparency, human oversight
  • DPIA: Data Protection Impact Assessment typically required
  • Algorithmic Impact Assessment: May be required under some jurisdictions

Safeguards: Both GDPR and AI Act require human oversight mechanisms, ability to contest decisions, transparency about profiling logic, and measures to ensure accuracy and prevent discrimination.

Related concepts: Profiling, Automated Decision System, Consequential Decision, Algorithmic Discrimination

Sources

  • GDPR Article 22
  • EDPB Guidelines