Research On Profiling And Its Legal Regulation

Profiling Refers to automated processing of personal data using techniques such as big data technologies and machine learning to evaluate and predict the certain personal aspects relating to a data subject,in particular to analyze or predict aspects concerning that data subject's performance at work,economic situation,health,personal preferences.After the prediction or evaluation,it will be applied to make specific decisions on the data subject.For example,it will be used to determine whether the data subject is eligible for credit.With profiling,the production and marketing efficiency of commercial organizations can be greatly improved,and users can enjoy the more convenient and efficient services provided by commercial organizations.This technology has gradually been applied in various industries such as advertising,banking,insurance,and healthcare at present.While profiling brings benefits,it also brings about two issues.The first issue is that it may infringe on the privacy of the data subject.In order to portray accurate profile,businesses must collect and process as much of the user's personal data as possible.Whether their behaviors are in line with legal norms and whether it will infringe on the privacy of data subjects are in question.The second issue is that this technology may destroy the fair value of business transactions.Profiling relies on automated algorithms to make decisions,and its operation is a “black box” to the data subject.At the same time,due to unavoidable human and systemic factors,such black boxes will inevitably make more or less erroneous or discriminatory outputs.In the current situation,even if the algorithm makes a wrong or discriminatory decision on data subject,the data subject cannot relieve themselves.A series of questions concerning profiling therefore arises,such as whether profiling break the fair balance between the two parties in the transaction? Whether the algorithm of profiling should be regulated by law? And if necessary,how should we establish the regulations?In order to answer the above questions,this essay disassembles the process of profiling,and finds out the legal issues arising out of it,and then further discusses the privacy issues and fairness issues and their regulations respectively.While discussing each issue,this essay will analyze related issues in turn,and review the regulations and regulatory effectiveness of existing legal system in China.Besides,it will introduce international legislations before discuss the idea of supervision in China.In the process of writing,the author used a combination of literature research method and comparative research method.In addition to the introduction part and conclusion part,this essay mainly includes the following three chapters:The first chapter disassembles the process of profiling to find out the possible privacy violations and fair imbalances.In general,the process of profiling consists of three main steps: collecting personal data,finding out the relevance,and assessing or predicting specific aspects of the data subject.During the process of establishing profile,commercial organizations not only collect basic personal data such as names and birth dates from data subject,but also capture dynamic personal data from all areas of user's life.These data form the “data pool” for profiling.Business organizations use big data and machine learning technologies to analyze and compare data in data pools to construct user data models before they use automated algorithm to assess or predict specific aspects of the data subject.The results of these assessments or prediction will ultimately be applied by commercial organizations to make a specific decision on the data subject.During this process,the behavior of the commercial organization in the following two steps may infringe on the personal privacy of the data subject.The first one is the data collection process.In order to profile data subject,commercial organizations apply big data technologies to collect personal data from various fields of user's life.In most cases,data subjects are not aware of this,and these data often exceed the needs of commercial organizations at that situation to provide services.The second step is the data processing.In this step,commercial organizations apply big data and artificial intelligence to reorganize and compare personal data from different channels.This action may not only be beyond the original authorization of the data subject,but also highly likely crack new privacy information that data subjects do not want to disclose.On the same time,the algorithm black box of profiling may bring about the problems of fair imbalance.The reason why the process of automated decision-making algorithm is called black box is that its decisions are made automatically by the machine with the machine learning technology.Unless the program developer provides a detailed explanation,the data subject cannot understand the logic and reference factors associated with the above decision.This causes severe information asymmetry between the data subject and the algorithm user.Due to the existence of the algorithm black box,the errors or discriminatory factors inside the automated decision-making algorithm itself and the personal data with which the algorithm makes decisions are obscured.When the data subject encounters the adverse effects of profiling,it is unable to confirm whether the decision of profiling is wrong or discriminatory.And it is impossible to seek any relief under this situation.The data subject may even simply fail to detect that it has been mistakenly recognized or discriminatorily treated under some situations.It brings a severe test to the fairness of business transactions.The second chapter focuses on the privacy issue that profiling brings about and the solution of it.The author believes that the privacy issue caused by profiling is a part of personal data protection in the context of big data.Its essence is the regulation of personal data collection and processing.Based on the analysis of China's personal data protection legislation,this essay summarizes that the legal framework for the regulation of personal data collection and processing in China is the informed-choice mechanism.This mechanism is based on the concept of contract and attempts to facilitate the agreement concerning the collection and processing of personal data between the business organization and the data subject for enabling the data subject to control their personal data to protect their privacy.However,in the context of big data and the Internet of Things,due to the diversity of data collection channels and the diversity and complexity of data processing methods,data subjects cannot always know the information related to data collection and processing when personal data is collected.Thus,data subject cannot always give consent to personal data collection and processing without adequate rational basis,which means that the traditional informed-choice mechanism cannot properly solve the privacy problems caused by profiling.And the reform is urgently needed.After examining the privacy protection regulations related to personal data processing in the European Union and the United States,this essay argues that China should abandon the informed-choice mechanism and apply the Contextual Integrity Theory and the Risk-based Approach to regulate privacy issue.The key idea of this framework is to analyze whether the data processing behavior infringes personal privacy under a specific context.It determines whether the data processing is reasonable by examining whether it meets the privacy expectation of the data subject under that specific context.Considering that the privacy risks under different contexts differ,this framework requires commercial organizations to adopt different privacy protection measures.Finally,the tort law framework is applied as the remedy for the data subject.Once the commercial organization improperly uses personal data and infringes the privacy of the data subject,the data subject can defend the rights according to law.The third chapter focuses on the imbalance and regulation problems of the profiling algorithm.First of all,according to the functions of profiling,this essay divides the usage contexts of profiling into trend prediction context and qualification assessment context.After respectively analyze the typical examples of two types of profiling usage contexts,this essay draws preliminary conclusions that no matter in which type of profiling usage context,the wrong or discriminatory profiling may infringe on the legal or economic interest or other types of legal interests,while the data subject cannot relieve themselves.Considering the extreme opacity of the profiling process,this essay proposes that the first step to remedy the data subject is to require the commercial organization to disclose the information related to algorithm operation.After examining the existing legal system in China,this essay finds that none of the Contract Law,the Tort Law and the Consumer Rights Protection Law can provide appropriate relief for the data subject.Therefore,it is necessary to explore the establishment of a new regulatory framework for profiling.After analyzing the interests of the stakeholders involved in the use of profiling,this essay concludes that the purpose of profiling regulation is to provide necessary relief for data subjects while guaranteeing the legitimate use of profiling technology.In order to achieve this purpose,the regulatory means of profiling selected in China should conform to the principle of proportionality,which means that we should apply different regulatory means to different profiling using contexts.In order to further explore China's profiling institutional arrangements,this essay examines the relevant legislations of the European Union.By doing so,the author finds that EU is regulating profiling with different means according to contexts.However,the relevant legislations of the European Union still have some deficiencies in the aspects of dividing contexts and choosing specific normative means.Finally,this essay argues that we should consider the using purpose,whether the use of profiling substantially changes the trading position between commercial organizations and data subjects,and the extent to which profiling affect commercial organizations in making adverse decision on data subject before dividing the profiling using contexts.Under the context where the profiling dominates the specific decision-making,and the decision directly infringes on the legal rights or economic interests of the data subject,while the market mechanism cannot help the data subject to relieve themselves,profiling should not only be subject to prior restrictions,but also be subject to ex post review.The prior restriction here refers to data subject's right to know.And the post hoc review means that the specific decisions made based on profiling should be restricted by data subject's right to algorithm explanation.With the right to algorithm explanation,the data subject can ask the business organizations to disclose the personal data on which the specific decision is based and the specific reasons for making the decision to check out whether the profiling has errors and discrimination.After that,data subject may ask business organizations to correct the relevant error and discrimination or request to withdraw from such profiling.For the use of general profiling,since the data subject still has the freedom to choose whether to continue to accept profiling when the commercial organizations make adverse decision on them,this essay argues that the law shall only need to configure the right to know to help them make rational choices.In addition,considering that excessive or erroneous and discriminatory,profiling-based marketing information has brought an increasingly widespread and profound problems to data subjects,this essay advocates that the law should give data subjects the right to refuse this kind of profiling at any time.