Profiling

Profiling is the automated analysis of personal data to evaluate or predict a person’s preferences, interests, behaviour, location, economic situation, health or reliability. Personalised advertising and product recommendations, credit scoring, insurance pricing, customer segmentation and candidate assessment software are typical examples.

Profiling under the KVKK

The KVKK does not define profiling separately; profiling is a processing activity subject to the KVKK’s general rules:

• It must rely on a legal basis. Marketing profiling usually cannot rely on another basis and therefore relies on explicit consent.
• The privacy notice must explain which data is used to build profiles and for what purpose.
• It must comply with the general principles, particularly being relevant, limited and proportionate to the purpose.

The Authority’s Recommendations on the Protection of Personal Data in the Field of Artificial Intelligence also contain principles on profiling systems.

The GDPR Definition

The GDPR defines profiling expressly: automated processing of personal data to evaluate certain personal aspects of a natural person, in particular to analyse or predict work performance, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements. Companies serving people in the EU should use this definition.

Risk Areas

• Profiling with special categories of personal data such as health or biometric data is only possible under the conditions in Article 6 of the KVKK.
• Profiling of children requires particular care; see Targeted Advertising with Personal Data.
• Where decisions are made about the person without human involvement as a result of profiling, the rules on automated decision-making also apply.