My organisation does not carry out any automated decision making. We “profile” data subjects to target them for marketing purposes, i.e. we have a new product and look at who may be interested in it based on their previous engagement with us.
Would that come under “profiling” under GDPR please?
Smurf333
In UK GDPR you need to look at the legislation, which indicates that this is a decision making process that is completely automated without any human interaction to influence the outcome. The process is not considered automated should you have someone who assesses the results of the automated decision before taking action at their discretion in relation to the individuals identified. Thereafter you must consider does the automated decision have a legal or similar impact on the individual. So in weighing that up you need to decide if the automated decision impacts the person’s individual circumstances, behaviour or choices. My view would be that the provision of marketing material for a new product based on previous behaviours is unlikely to have a significant impact on an individual. I hope that helps?