Which of the following would NOT be relevant when determining if a processing activity would be considered profiling?

Question

Options

• AIf the processing is to be performed by a third-party vendor
• BIf the processing involves data that is considered personal data
• CIf the processing of the data is done through automated means
• DIf the processing is used to predict the behavior of data subjects

• A
  76% (13)
• B
  6% (1)
• C
  12% (2)
• D
  6% (1)

Explanation

The GDPR defines profiling as any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements. Therefore, the relevant factors when determining if a processing activity would be considered profiling are: whether the processing involves data that is considered personal data; whether the processing of the data is done through automated means; and whether the processing is used to predict the behavior of data subjects. The identity of the processor, whether it is the controller or a third-party vendor, is not relevant for the definition of profiling. However, it may have implications for the accountability and responsibility of the parties involved, as well as the data protection rights of the

No community discussion yet for this question.