CONSUMER PROFILING IN AIR TRANSPORT AND TOURISM economic availabilities, which are irrelevant for the purposes of a balanced corporate organisational approach and, therefore, an expression of abuse. 4. THE RULES ON THE PROCESSING OF PERSONAL DATA, AIR FARES AND PROFILING Unlawful processing of personal data can alter decision - making capacity. That is why, at the European level, the use of profiling has been delimited. Thus, for Article 4(4) of the EU Regulation No. 679 of 2016, this term is understood to mean any “automated processing of personal data consisting of the use (...) to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects of that person's professional performance, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements”47. In line with the Regulation and the indications of the Article 29 data protection working party48, profiling has three elements; it must be a form of automated processing, it must be carried out on personal data and it must be evaluated49. Therefore, the latter expression, referred to in Article 4(4) of the Regulation, must imply a judgement on the subject, for instance functional for inclusion in certain categories. Thus, classification on the basis of gender or age does not necessarily entail profiling, if it does not lead to a study of attitudes. In particular, the contributions of the aforementioned working group emphasized the predictive dimension50; future conduct should be deduced from the processing. If the notion is referred by Article 4(4) of the Regulation to any form of automated processing, Article 22 considers “the decisions that are 'based soley' on automated processing, including profiling”. According to the Guidelines on automated individual decision making and profiling for the purposes of the Regulation 2017 / 679, adopted on 3 October 2017, as last revised on 6 February 2018, a decision based on automated processing is one in which human involvement is absent. Thus, "if a human being reviews and takes 47 EU Regulation No. 679 of 2016 was implemented in Italy by Legislative Decree No. 196 of 2003, as amended by Legislative Decree No. 101 of 2018. 48 In 2018, the Article 29 data protection working party ceased to exist and was replaced by the European data protection board (EDPB). 49 See M. Nisevic, Profiling consumers through big data analytics: strengths and weaknesses of Article 22 GDPR, loc. cit., 108 ff. 50 See the Working Party Article 29's “Guidelines on automated decision – making relating to natural persons and profiling for the purposes of Regulation No. 679 of 2016”, adopted on 3 October 2017 as amended on 6 February 2018.
RkJQdWJsaXNoZXIy MTE4NzM5Nw==