Mensen aanwijzen maar niet bij naam noemen: behavioural targeting, persoonsgegevens, en de nieuwe Privacyverordening

TL;DR

This paper discusses how behavioural targeting involves collecting and using personal data for targeted advertising, emphasizing that data protection laws should apply regardless of whether companies tie data to names, due to privacy risks and the nature of individual identification.

Contribution

It argues that data protection law should apply to behavioural targeting because companies can often link data to individuals and the practice involves identifying and targeting individuals, regardless of explicit names.

Findings

Data protection law should apply to behavioural targeting.

Companies can often link data to individuals even without names.

Privacy risks persist regardless of whether names are attached.

Abstract

Information about millions of people is collected for behavioural targeting, a type of marketing that involves tracking people's online behaviour for targeted advertising. It is hotly debated whether data protection law applies to behavioural targeting. Many behavioural targeting companies say that, as long as they do not tie names to data they hold about individuals, they do not process any personal data, and that, therefore, data protection law does not apply to them. European Data Protection Authorities, however, take the view that a company processes personal data if it uses data to single out a person, even if it cannot tie a name to these data. This paper argues that data protection law should indeed apply to behavioural targeting. Companies can often tie a name to nameless data about individuals. Furthermore, behavioural targeting relies on collecting information about individuals, singling out individuals, and targeting ads to individuals. Many privacy risks remain, regardless of whether companies tie a name to the information they hold about a person. A name is merely one of the identifiers that can be tied to data about a person, and it is not even the most practical identifier for behavioural targeting. Seeing data used to single out a person as personal data fits the rationale for data protection law: protecting fairness and privacy.