top of page
  • Writer's pictureDurham Pro Bono Blog

The Legal Ethics of Data Profiling

Disclaimer: The views expressed are that of the individual author. All rights are reserved to the original authors of the materials consulted, which are identified in the footnotes below.

In today’s technological age, collecting and analysing big data allows companies to better understand customer behaviour and tailor their business strategy. However, the value of big data depends on how well it is profiled.

Data profiling helps organise and analyse data to yield its maximum value.[1]When data is not correctly formatted, standardised or integrated with the rest of the database, analysis of that data may become inaccurately skewed. This can lead to missed opportunities and bad decisions for businesses. According to The Data Warehouse Institute, data quality problems cost U.S. businesses more than $600 billion a year, as poor data quality leads to failure and delays of many high-profile IT projects.[2]Data profiling helps businesses alleviate these issues. It uses a toolbox of rules and algorithms to discover and expose inconsistencies in data.[3]This knowledge can then be used to improve the health of future data sets.

Data profiling is one of the most effective technologies for improving accuracy in corporate databases[4]. Companies can gain accurate insight into consumer preferences[5], effectiveness of advertising strategies and market trends.

Legal issues

1. Privacy concerns

E-commerce companies can create data profiles of their customers based on their search and purchase histories, allowing targeted advertising. Some customers argue this is an invasion of their privacy. Under Article 22(1) of the EU General Data Protection Regulation (GDPR)[6], there is a restriction against making solely automated decisions, including those based on data profiling, that have a legal or similarly significant effect on individuals. For something to be ‘solely automated’ there must be no human involvement in the decision-making process.[7] As such, companies engaging in data profiling need to be cautious of how they use their data to avoid falling foul of such regulations and paying hefty fines.

Furthermore, data profiling may conflict with the Right to be Forgotten under Article 17 of the GDPR[8]. As first established in Google Spain[9], personal data must be erased immediately where the data are no longer needed for their original purpose, or the data subject has his consent and there is no other legal ground for processing the data. Thus, companies need to ensure that they are compliant and have processes in place to delete data upon request.

In the industrial world, the Internet of Things introduces a multitude of devices generating data, while organisations can access data from biometrics and human-generated sources like email and electronic medical records. [10] For instance, the e-commerce giant, Amazon, has released Alexa, a home-automation device. In a hypothetical situation where unregulated data profiling is conducted by Amazon, an Alexa may be able to collect and analyse their user’s health data if it is linked with their email account, which could allow Amazon to recommend certain health products to the user. While this may increase convenience for the user, one might feel wary that their personal data may be used for targeted advertising.

2. Restricting competition

Data profiling requires huge pools of data to ensure accuracy of results. When large companies gain a majority share in a market, they gain a large consumer base and therefore also gain a monopoly on consumer data. This allows them to conduct data profiling more successfully, boosting their performance which further increases their power as a dominant market player. If the European Competition Authorities perceive this as anti-competitive behaviour, such companies could face potential sanctions.

3. Effect on politics

The Facebook–Cambridge Analytica data scandal highlights the dangers of using data profiling in political advertising[11]. In 2018, it was revealed that Cambridge Analytica (CA) had harvested the personal data of millions of people's Facebook profiles without their consent and used it for political advertising purposes, including President Trump’s presidential campaign. This scandal triggered calls for tighter regulation of tech companies' use of personal data. CA used Facebook profiles to determine a person’s political inclinations, then tailored political advertisements on their news feed to influence voters in the US presidential elections. Given the tech-driven landscape and wide use of social media today, it is important for regulators to safeguard against such exploitation of personal data to prevent severe injustice.

In conclusion, data profiling can be used to benefit consumers and businesses, if regulated and used responsibly. However, one should not ignore the inherent risks in conducting mass-analysis of personal data as it can be over-exploited for commercial and political gain at the expense of consumer privacy. Therefore, there is a need for the law to keep abreast with technological advancements and regulate this dynamic area of data profiling.

Su-Ann Cheong

Section Editor

Technology and Media


[1] Research Data Alliance, ‘What is Big Data?’ (Research Data Alliance) <> accessed 18 Feb 2020.

[2] Wayne Eckerson, ‘Data Quality and the Bottom Line’ (TDWI Reporting Series) <> accessed 18 Feb 2020.

[3] John Bauman, ‘What is data profiling and how does it make big data easier’(Analytics Software & Solution)

<> accessed 18 Feb 2020. [4] Olson, Jack E. Data Quality: The Accuracy Dimension (2003)140–142.

[5] Ibid (n 4).

[6] Article 22(1), General Data Protection Regulation (EU) 2016/679.

[7]Information Commissioner’s Office, ‘Rights related to automated decision making including profiling’ (ICO) <> accessed 18 Feb 2020.

[8] Article 17, General Data Protection Regulation (EU) 2016/679.

[9] Google Spain SL, Google Inc v Agencia Española de Protección de Datos, Mario Costeja González [2014] Case C-131/12.

[10] Ibid (n 3).

[11] Kevin Granville, ‘Facebook and Cambridge Analytica: What You Need to Know as Fallout Widens’ The New York Times (New York, March 19 2018).

440 views0 comments

Recent Posts

See All


bottom of page