Profiling and manipulating human behaviour: a core contemporary privacy concern

1. Profiling and manipulating human behaviour: a core contemporary privacy concern Alan Mckenna (A.V.Mckenna@kent.ac.uk) Thessaloniki – May 2011

2. ‘PlayStation Hackers May Have Stolen Data on 75 Million Users, Sony Says’ (Bloomberg – 27th April 2011) ‘Apple iPhone tracks users' location in hidden file’ (Daily Telegraph – 20th April 2011)

3. ‘The right to be let alone’

4. Privacy harms • Subjective category – the perception of unwanted observation. 2. Objective category – the unanticipated or coerced use of information concerning a person against that person. (M. Ryan Calo – ‘The Boundaries of Privacy Harm’, Indiana Law Journal (2011) 86(1).)

5. Profiling ‘The process of ‘discovering’ correlations between data in databases that can be used to identify and represent a human or nonhuman subject (individual or group) and/or the application of profiles (sets of correlated data) to individuate and represent a subject or to indentify a subject as a member of a group or category.’ (Mireille Hildebrandt 2008:19).

8. ‘Nudge’ by Richard Thaler and Cass Sunstein

9. ‘many of the pressing public policy issues we face today are equally influenced by how we, as individuals, behave. We can all cite instances in which we know that we should act differently in our own self interest or in the wider interest, but for one reason or another do not. The traditional tools of Government have proven to be less successful in addressing these behavioural problems.’ (Sir Gus O’Donnell – UK Government Cabinet Secretary)

10. Profiling Technologies • Cookies • Data Mining • RFID (Radio Frequency Identification) • GPS (Global Positioning Systems) • CCTV (Closed Circuit Television)

11. Applicable EU privacy regulatory provisions EU Charter of Fundamental Rights: • Article 7 Respect for private and family life • Article 8 Protection of personal data Treaty on the Functioning of the EU: • Article 16 Directive 95/46 (Data Protection Directive) Directive 2002/58 (e-Privacy Directive) as amended by Directive 2009/136

12. Amended Art. 5(3) Directive 2002/58 – moving from an opt out to opt in system ‘the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given his or her consent, having been provided with clear and comprehensive information, in accordance with Directive 95/46, inter alia, about the purposes of the processing’. (NB. Cookies are considered information)

13. EU Justice Commissioner Viviane Reding’s four privacy pillars • The right to be forgotten • Transparency • Privacy by default • Protection regardless of location

14. Conclusion There arguably is no one solution in looking to protect individuals from manipulative use of their personal information. We must look to use all forms of protection available in an holistic approach – a strong underlying regulatory framework; self regulation where appropriate; privacy by design; privacy enhancing technologies; information provision via for example website Icon’s; and EDUCATION