Should behavioral advertising profiles qualify as “personal information”?

The Economist published a great piece on behavioral advertising today: “Getting to know you: Everything people do online is avidly followed by advertisers and third-party trackers”. The article discusses the fact that gathering information about users and grouping them into sellable “segments” has become important for the $120 billion online advertising economy.

The article raises an interesting point: industry players often take the position that since they do not know the users’ names, what they are collecting is not in fact “personal information”. They identify users by numbers, and build up detailed profiles about them. In Canada, the Office of the Privacy Commissioner has closed the door on the issue in its 2012 Policy Position on Online Behavioural Advertising and usually considers profiles created for behavioral marketing as “personal information”:

Taking a broad, contextual view of the definition of personal information, the OPC will generally consider information collected for the purpose of OBA to be personal information, given: the fact that the purpose behind collecting information is to create profiles of individuals that in turn permit the serving of targeted ads; the powerful means available for gathering and analyzing disparate bits of data and the serious possibility of identifying affected individuals; and the potentially highly personalized nature of the resulting advertising.

In Europe, the Article 29 Working Party has recently proposed, in a recent Opinion issued in the context if the EU reform, to extend the definition of personal information currently defined as “any information concerning an identified or identifiable person” to also include “or any information allowing a natural person to be singled out and treated differently.”

If this new definition was eventually adopted in the EU, online behavioural profiles would be considered as “personal data”, even if these profiles can’t be linked to an identifiable individual, as long as the individual behind the profile was considered as being singled out and treated differently.

This content has been updated on September 19, 2014 at 19 h 35 min.