Profiling and Cybersecurity: A Perspective from Fundamental Rights’ Protection in the EU

In this text we will be assessing to what extent personal data protection is related to the development of AI systems, as well as testing to what extent the General Data Protection Regulation (GDPR) (Regulation 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.) enables the defense of individuals in the face of some AI applications—especially with regard to profiling and automated decisions. Considering the GDPR regulates the processing of data of an identified or identifiable natural person, it would apply when AI systems are building on everyone’s data, as well as when such systems are used to analyze data and produce inferences on individuals (Datatilsynet - The Norwegian Data Protection Authority, Artificial intelligence and privacy, Report: Oslo, 2018). Herein lies the problem of the opacity of inferences or predictions resulting from data analysis by AI systems—inferences whose application to everyday situations determines how each of us, as personal data subjects, are perceived and evaluated by others. It is important to assess the existence of legal remedies to challenge operations that result in automated inferences that are not reasonably justified. Thus, we intend to clarify whether the GDPR adequately protects inferred data, in the light of the fundamental right to the protection of personal data provided in Article 8 of the Charter of Fundamental Rights of the European Union (CFREU), under penalty of violating our insusceptibility to instrumentalization and objectification—in other words, human dignity itself.