Controlling Your Online Profile: Reality or an Illusion? A Research into Informed Consent as a Mechanism to Regulate Commercial Profiling
Informational privacy is the right of an individual to determine for himself what information to share with which person. For informational privacy to be adequate protected individuals should have sufficient possibilities to give or withhold free, specific and informed consent to the proposed use.
Informed consent is the mechanism for consent on the Internet. Controllers are obliged to provide the data subject with information, which are usually presented in privacy policies or terms and conditions. Based on this information the data subject consents to the proposed use. Consent is usually an action, which signifies acceptance of the terms and conditions.
The European Commission has proposed a massive reform of the current data protection law. The proposed Data Protection Regulation (hereafter: Regulation) aims at enhancing the mechanism of informed consent, by increasing and clarifying the obligations of controllers and strengthening the rights of data subjects.
Internet companies, such as Google and Facebook, use informed consent to establish profiles about their users and subsequently earn money of these profiles. However, several risks are connected to profiling, relating to inter alia discrimination, stereotyping and stigmatisation. In addition, profiles may not correspond with reality if they are based on flawed information. This might result in incorrect decisions being taken. Moreover, profiling results in privacy risks as data subjects are becoming increasingly transparent to companies.
This thesis aims to research whether informed consent, as proposed in the Regulation, is a suitable mechanism for data subjects to effectively regulate the use of their data by companies for profiling purposes.
It is argued that informed consent is a mechanism that works in theory only. Control over personal data would be feasible in practice if Internet companies would uphold the rules and if these companies are sufficiently monitored. However, processing activities are often difficult to understand because of their complex and obscure nature. This makes supervision complicated and almost impossible. In addition, data subjects are uninterested and often unaware of what they are consenting to. In addition, these data subjects are seldom aware that they are a product and represent a certain economic value. Moreover, data subjects lack market options. Leaving cyberspace and stop using the Internet completely is hardly an option nowadays. Furthermore, personal data are permanently collected and continuously processed for never-ending purposes. However, by upholding the purpose limitation principle society is unable to truly benefiting from Big Data. Services, such as Google Street View, would not be possible.
Therefore, informed consent does not allow data subjects to effectively regulate the use of their information, nor is the mechanism likely to resolve the risks related to profiling. Therefore, I urge the Union legislators to seriously look for alternatives for informed consent, as I fear this mechanism will become completely meaningless.
Several recommendations and alternatives are put forward to solve the informed consent problem. Informational norms might be created or the accountability of Internet companies could be increased. These options should be further researched.