Profiling the profilers: analysing the gathering and mining of personal data for online marketing purposes based on Privacy Impact Assessment approach

Companies rely on personal data for (online) marketing but also for minimalising costs by improving their understanding of customer behaviour through data mining and profiling (Hildebrandt, 2008). The obscurity surrounding the usage of personal data has led to distrust among users and regulators. The European Commission proposed a new regulation (as a revision of the data directive 95/46/EC), which includes Privacy Impact Assessments (PIAs). PIA is seen as a means to assess current business practices and to adjust them if they are not in compliance with the law and - more importantly - with the preferences of the stakeholders to whom the data belongs. A large part of the marketing sector is opposed to this approach while this is not necessarily a threat to their business. Vendor companies like Nokia, Siemens and Vodafone (Wright, 2012) have already adopted the reasoning underlying PIA's that to prevent is better than to cure reputation damage caused by data breaches or distrust.
In our research we start a value network perspective, which serves to describe the commodification of personal data. The value network model of Ballon (2007) is used to describe the different business models that rely on personal data. This specific focus already exists in various international PIA approaches (Clarke, 2009; Wright, 2012). These PIA approaches ideally describe a proposal of a project or process. Possible privacy issues are evaluated with stakeholders and the project or process is then adapted accordingly. This approach enables Privacy by Design (Cavoukian, 2009). Since we will be looking at implemented practices we will only use the descriptive part of the PIA process to identify the flows and sorts of personal data in the commodification process of a company.
The goal of this research is to start mapping and analysing the current online data gathering and data mining practices in marketing companies in Flanders (Belgium), based on the PIA approach. Our mapping will describe different business models respective to the various companies that thrive on online obtained personal data. To gather this information we have done document analyses and expert interviews with Belgian experts that commodify personal data. This research took place in Summer 2012. This is part of the surveillance and privacy research component in the four-year interdisciplinary project 'EMSOC - User Empowerment in a Social Media Culture' (www.emsoc.be) in Flanders (Belgium).
The outcome will provide us with a detailed picture of current personal data practices and how these companies operate in the Belgian online marketing landscape. This data will be used as input in future research in order to assess the position of Flemish users regarding these practices. Apart from illustrating the current affordances of the online marketing industry, this project will also reveal how willing and able current marketing organisations are to perform a PIA and eventually reorganise accordingly if needed. This question is important for Flanders (Belgium) because it has little experience with the PIA approach for the moment and the marketing sector is worried about the implementations of the new EU data protection regulation.

Jaar van publicatie:2012

Trefwoorden:privacy, PII, social media, privacy impact assessment, digital media marketing, personal data