Privacy, Guarantor establishes limits of profiling

The Privacy Guarantor has pronounced on the profiling of customers of Internet services and interactive television, specifying that this is possible only if there is the consent of users and compliance with privacy rules. In particular, the Guarantor did not consider lawful a new method of profiling its customers proposed by a telecommunications company based on monitoring their Internet browsing. Instead, it gave the same company the go-ahead, under precise conditions, to a system aimed at analyzing the activities of customers of interactive TV services.

In the case of monitoring Internet browsing, reads the newsletter of the Guarantor, the Authority responded to a request for preliminary verification in the context of the so-called behavioral advertising and personalized services on the Internet: the company providing the connection service asked to be able to analyze the online behavior of surfers, without having acquired their consent, in order to propose targeted advertising. The company claimed that it could carry out such processing because the personal data of individual users before being used was anonymized. From the feedback of the Guarantor, however, it emerged that the process that should have concealed the identity of the customer was by its nature reversible, so much so that the profiling services carried out by the telephone company could have allowed to propose to the user offers calibrated precisely on his online life. The Authority has therefore prohibited the activation of the project which, as presented, could only be carried out with the prior acquisition of the specific consent of users and, in any case, always subject to preliminary verification by the Guarantor.

The same telecommunications company had submitted to the Guarantor another preliminary check in which it asked instead to be able to monitor – for commercial, advertising and customer care purposes – the activity of subscribers to interactive TV services. The company proposed in particular to analyze, once their consent was requested, the data transmitted on the so-called "return channel", i.e. the connection that allows the user to interact with the TV platform to access programs, write messages or comments, configure specific features and services. In this case, the Guarantor approved the project: the company will still have to take precise measures to protect the privacy of the persons concerned. The analysis of the data will have to be limited to creating profiling groups based on macro-categories of consumption (eg action films, comedies…) and with an analysis period of not less than a week. Sensitive data may be used only if strictly connected to a specific good or product requested by the user and in any case only after obtaining the written consent of the interested party and the specific authorization of the Authority. The Guarantor has also requested the adoption of security measures that prevent forms of cross-profiling between telephone and television users.