Singling out people without knowing their names -- Behavioural targeting, pseudonymous data, and the New Data Protection Regulation

TL;DR

This paper argues that behavioural targeting data should be protected under data law because it involves singling out individuals, even without tying data to names, highlighting ongoing privacy risks.

Contribution

It challenges the view that pseudonymous data is outside data protection law, emphasizing that behavioural targeting inherently involves personal data regardless of identifiers.

Findings

Companies can often link data to individuals even without names

Behavioural targeting involves singling out and targeting individuals

Privacy risks persist regardless of data anonymization

Abstract

Information about millions of people is collected for behavioural targeting, a type of marketing that involves tracking people's online behaviour for targeted advertising. It is hotly debated whether data protection law applies to behavioural targeting. Many behavioural targeting companies say that, as long as they do not tie names to data they hold about individuals, they do not process any personal data, and that, therefore, data protection law does not apply to them. European Data Protection Authorities, however, take the view that a company processes personal data if it uses data to single out a person, even if it cannot tie a name to these data. This paper argues that data protection law should indeed apply to behavioural targeting. Companies can often tie a name to nameless data about individuals. Furthermore, behavioural targeting relies on collecting information about individuals, singling out individuals, and targeting ads to individuals. Many privacy risks remain, regardless of whether companies tie a name to the information they hold about a person. A name is merely one of the identifiers that can be tied to data about a person, and it is not even the most practical identifier for behavioural targeting. Seeing data used to single out a person as personal data fits the rationale for data protection law: protecting fairness and privacy.