Automated Profiling

For processing to constitute automated profiling, three elements must be present simultaneously:

• Automated Processing: The evaluation is performed by a machine without meaningful human intervention in the analytical phase.
• Personal Data: The input data must relate to an identified or identifiable natural person.
• Evaluative Purpose: The goal is to analyze or predict personal aspects, not merely to classify objects or perform administrative sorting.

Without all three, the activity is simply automated processing, not profiling.

Profiling and automated individual decision-making are distinct but related concepts under the GDPR:

• Profiling is the act of evaluation or prediction. It can occur without any subsequent decision.
• Automated Decision-Making (Article 22) is the act of making a decision solely by automated means that produces legal or similarly significant effects.

A system can profile without deciding (e.g., segmenting customers for manual review), and it can decide without profiling (e.g., an automated refund based on a fixed rule). The highest regulatory scrutiny applies when both are combined.

Profiling systems synthesize personal aspects from multiple data categories:

• Observed Data: Transaction histories, location traces, clickstream logs.
• Derived Data: Calculated attributes like customer lifetime value or churn probability.
• Inferred Data: Predictions about future behavior, interests, or creditworthiness generated by machine learning models.

Inferred data is particularly sensitive because the data subject may be unaware of its existence, cannot verify its accuracy, and has limited ability to contest it. The GDPR grants a right to meaningful information about the logic involved in these inferences.

Profiling that reveals or infers special categories of personal data—racial or ethnic origin, political opinions, religious beliefs, health data, or sexual orientation—is subject to heightened restrictions under Article 9 of the GDPR:

• Explicit consent is generally required unless a specific exemption applies.
• Profiling that inadvertently creates proxies for protected characteristics (e.g., zip code as a proxy for race) may still trigger Article 9 obligations.
• The EU AI Act classifies biometric categorization systems that infer sensitive attributes as high-risk or prohibited depending on context.

Controllers conducting automated profiling must satisfy specific transparency requirements under Articles 13-15 and 22 of the GDPR:

• Meaningful Information: Provide the logic involved in the profiling process, not just the mathematical formula but an explanation of the rationale and envisaged consequences.
• Right of Access: Data subjects can request confirmation of whether they are being profiled and obtain a copy of the personal data undergoing processing.
• Right to Object: Article 21 grants an absolute right to object to profiling for direct marketing purposes and a qualified right for other legitimate interests.

Under the EU AI Act, deployers of high-risk AI systems must inform individuals they are subject to such systems.

The EU AI Act identifies specific profiling practices as unacceptable risk and prohibits them outright:

• Subliminal Manipulation: AI systems deploying subliminal techniques beyond a person's consciousness to materially distort behavior and cause harm.
• Exploitation of Vulnerabilities: Profiling that exploits vulnerabilities of persons due to age or disability to distort behavior.
• Social Scoring: Public authority evaluation or classification of individuals over time based on social behavior or personality characteristics leading to detrimental treatment.
• Real-Time Remote Biometric Identification: Use of profiling in publicly accessible spaces for law enforcement, with narrow exceptions.

An automated or semi-automated decision that produces a legal effect or similarly significant impact on an individual. This includes decisions affecting employment, creditworthiness, access to essential services, or educational opportunities. Under the EU AI Act, automated profiling that leads to a consequential decision triggers heightened transparency obligations and the right to human intervention. The decision must be more than trivial—it must materially alter the individual's circumstances or rights.

The legal standard requiring that a human reviewer possesses the competence, authority, and actual capacity to override an automated profiling output. This goes beyond a tokenistic rubber-stamp. The reviewer must:

• Understand the factors that led to the automated result
• Have access to all relevant input data
• Possess the institutional authority to reverse the decision
• Document the rationale for any override Without these elements, the 'human in the loop' is merely a procedural fig leaf.

A mandatory, documented process under the EU AI Act for deployers of high-risk AI systems, including those performing automated profiling. The FRIA evaluates:

• The specific categories of individuals likely to be affected
• The risks to their dignity, privacy, non-discrimination, and due process
• The severity and probability of harm
• Mitigation measures to reduce identified risks This assessment must be completed prior to deployment and updated when the operational context changes.

The technical infrastructure required to fulfill privacy requests triggered by automated profiling. Under GDPR Article 22, individuals have the right not to be subject to solely automated decisions producing legal effects. This requires systems to support:

• Access rights: Providing meaningful information about the logic involved
• Right to explanation: Delivering interpretable rationales for specific decisions
• Consent management: Tracking and honoring opt-outs from profiling
• Rectification: Correcting inaccurate input data that led to erroneous profiles

The set of techniques used to render the outputs of automated profiling systems interpretable to human auditors. Key methods include:

• Feature attribution: Identifying which input variables most influenced a specific profile score
• Counterfactual explanations: Showing what minimal changes would alter the outcome
• Surrogate models: Training simpler, interpretable models to approximate complex profiling logic Explainability is not optional—it is a regulatory prerequisite for contesting automated decisions.

The systematic evaluation of automated profiling models for disparate impact against protected groups. Profiling systems trained on historical data often perpetuate existing societal biases. Fairness testing involves:

• Demographic parity: Ensuring profile outcomes are independent of sensitive attributes
• Equalized odds: Verifying equal error rates across groups
• Intersectional analysis: Testing for compound bias affecting overlapping marginalized identities Continuous monitoring is required, as bias can emerge post-deployment due to data drift.