Viviane Reding said that she wants to ensure that both formal decisions and also "'measures' producing legal effects or significantly affecting" individuals which are based on automated profiling are generally banned. The plans could impact on some targeted advertising, she said.
"For instance, the targeted marketing of specific medical products against cancer based on the search made by an individual on the internet would fall under this concept of 'measure'," Reding said in a speech earlier this week.
The commissioner was commenting after justice ministers from across the EU met to discuss plans to reform the existing Data Protection Directive from 1995. A new General Data Protection Regulation is envisaged in its place.
The Greek Presidency of the Council of Ministers which chaired the meeting of justice ministers in Brussels has proposed curbs to automated profiling.
"The Presidency intends to ensure that the individual should be protected against decisions taken solely on the basis of automated processing, including profiling which produces legal effects concerning him or her or (which) severely affects him or her," the proposals issued prior to the meeting said. "The current text seeks to prohibit the decision-making based on automated processing, namely (but not exclusively) through profiling, but not the creation and use of profiles as such."
"Automated decision-making should be allowed if necessary for the entering and performance of a contract, on the basis of explicit consent of the data subject or when explicitly authorised by [EU] or member state law, including for fraud and tax evasion prevention and monitoring purposes. Profiling and automated decision-making based on special categories of personal data should only be allowed under specific conditions," it said.
The existing EU Data Protection Directive provides individuals with a general right not to be subject to any decision "which produces legal effects concerning him or significantly affects him and which is based solely on automated processing of data intended to evaluate certain personal aspects relating to him, such as his performance at work, creditworthiness, reliability, conduct", among other things. Some exceptions apply to the rule.
In her speech, Reding said she wanted to see similar protections against automated profiling enshrined in the new Regulation.
"The Regulation [as drafted currently] strikes an appropriate balance between the rights of citizens and the need to encourage the emergence of innovative business models," Reding said. "Regulating the manner in which such profiles are created and used adds red tape for businesses and interferes with their research and innovation abilities."
"In any case, as profiling involves the processing of personal data, all the general safeguards provided for in the Regulation (both substantive – such as rules on sensitive data – and procedural – such as data protection impact assessments) apply," she added.