Group Privacy
The concept of privacy is often limited to the sphere of the individual, since it is the dimension most addressed by the regulations. However, most persons are not subject to processing as individuals but as members of specific groups, where groups are the focus of interest. The concept of group privacy has been developed around this idea, among others, by the philosopher Luciano Floridi and the scientists Linnet Taylor and Bart van der Sloot.
Image of John Schnobrich at Unsplash
Group privacy may be defined as privacy corresponding to groups defined by any characteristic or combination of characteristics associated with certain individuals.
The profiling of individuals and their processing by, for example, the State or Internet services, may be considered one of the most important risks to privacy. The approach to privacy considering the individual in isolation has a historical origin, since the level of technology in the past limited the possibilities of mass processing of population data. However, advances in information processing techniques, such as Big Data or Artificial Intelligence, have introduced new aspects to be taken into consideration. According to the philosopher Luciano Floridi, most people are not profiled as individuals, but as members of a specific group, and the resulting threats are not given adequate relevance.
In this case, a group is a set of people. Belonging to a group may arise from an individual's own initiative, through a conscious and voluntary action, e.g. joining a club or an association (ascribed group according to Mittelstadt). Similarly, group feeling may arise from some characteristic that the individual assumes is shared and links him or her to other persons, such as a political ideal, a place of birth, or an education (collective group).
However, a third party stakeholder may define groups by establishing, for example, that individuals who own the same type of car, buy the same type of food, share the same level of purchasing power, select the same online content, live in the same neighbourhood, have a specific gene, suffer from the same infection, etc. belong to a group. These groups, referred to as ad-hoc, do not have a list of members and their participants are not always aware of belonging to them. One step further occurs when these groups are established not from a positive action of a person, but automatically from the abstract definition of an AI that "algorithmically groups" individuals based on a data set.
Once the ad-hoc group has been established, an associated profile could be filled in with aggregate data on this group of persons in various ways. One way is to make use of open data sources, such as district election results. Said profile could also be created by using Big Data techniques on aggregate data from the digital technology used by individuals (apps, IoT, navigation data, geolocation, etc.). With regard to the foregoing, it is also possible to enrich the information of the group by making inferences about the information added to it by means of predictive models developed through machine learning. The profile may even be enriched by tracking and analysing specially selected individuals assigned to such groups, the results of which are extrapolated to the whole group.
In this way, the data used to generate the group profile may not be considered personal data, but may include information that may fall within special categories of data. Ad-hoc generated groups would not benefit from any effective protection regarding the generated profiles since they are not established as such and are not subject to any legal form. Profiling and inferences about these groups would lack any legal protection.
On this basis, entities would be able to adopt decisions about individuals taking into account qualities that have been established in the group in which the individual has been included. Regardless of the person's perception of his or her own individuality, of his or her disassociation from the interests or characteristics of other persons, the subject will be evaluated according to the profile assigned to said group.
The application of the group's profile on the individual could adopt different forms. For example, an audiovisual content distribution platform could try to guide the preferences of subscribers in the same area according to the profile assigned to the group, so that it offers content that is more adequate for its commercial and management strategy. An individual who is a customer of a certain product or service may receive "personalised suggestions" that guide his or her choices based on the group to which he or she is assigned. A chain of shops could adapt its offer and marketing to the profile associated with a certain postal code. Similarly, depending on said group profile, it would be possible to adapt proposals, services or other measures to individuals who attend specific areas, or at certain times, or according to their age.
In this regard, the creation of a group allows the application of what is called "generalisable knowledge", which implies universalising to all members certain characteristics that are common to only some of them. For example, generalisable knowledge that smoking causes cancer exposes all smokers to higher health insurance prices.
These processing operations pose risks for individuals, not only because of their implicit inclusion in a group of which they are unaware, but because there are decisions that affect them and they may be affected by biases of which the extent and possible consequences are unknown. We may face discriminatory consequences on the basis of gender, race, opinions, habits or specific geographical locations. Members of a group could be attacked or discriminated against without their knowledge.
Floridi states that group privacy protection is not automatically achieved by protecting individual privacy. For this reason, there is a groundswell of opinion that current regulation, based on the personal identification of information, should be complemented by a focus on the identification of information about categories or groups. Indeed, some experts consider that group rights are at the origin of the current human rights framework. It must be borne in mind that rights such as religious freedom or the rights of ethnic minorities originate from groups.
A relevant conclusion is the awareness of individuals about the importance of preserving their own privacy, which goes beyond the consequences it may have for their own privacy but may also affect the rights and freedoms of society as a whole. This is not an obstacle to the countless potentials of technology, but rather a condition for this potential to be fulfilled responsibly.
Other recommendations drawn up by the AEPD may be found on the Innovation and Technology microsite, particularly those related to privacy policies and data protection principles:
