Digitalization without alternatives: The risk of discriminating against elderly people

Image by Joshua Hoehne taken from Unsplash.

Digitalization allows more effective and efficient services, with obvious benefits in the framework of processing of personal data. However, digitalization should not imply the elimination of alternatives that allow citizens to enjoy the service without using digital means and that guarantee non-discrimination, the ability to act, the suitability of the processing, the correct management of the risk, availability and resilience of processing, which affect the fundamental rights of both elderly people and other vulnerable groups.

The Spanish Digital agenda, and its update on ‘España Digital 2026’ is the roadmap for the country’s digitalization, an ambitious strategy to take advantage of the benefits of new technologies and achieve a stronger and more sustained economic growth, with quality employment and higher productivity, that contributes to social and territorial cohesion and drives prosperity for all citizens. This strategy is part of the Digital Europe Programme, and supports projects in supercomputing, artificial intelligence, cybersecurity or advanced digital capabilities to ensure broad use of digital technologies throughout the economy and society.

Digitalization means promoting, in the case of personal data processing, a way of implementing this processing prioritizing digital media.

But it should not be forgotten that any personal data processing must guarantee compliance with the GDPR, taking into account that the exclusive choice of digital means to implement processing can put at risk to fundamental rights of some groups, such as the non-discrimination right (Art. 14 Spanish Constitution) or ability to act right (art.322 Spanish Civil Code).

In that sense, Recital 75 of the GPDR interprets that “The risk to the rights and freedoms of natural persons, of varying likelihood and severity, may result from personal data processing which could lead to physical, material or non-material damage, in particular where the processing may give rise to discrimination, … or any other significant economic or social disadvantage where data subjects might be deprived of their rights and freedoms or prevented from exercising control over their personal data…”. Article 24 of the GDPR establishes that “Taking into account the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, the controller shall implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with this Regulation.”

It is worth considering that the digitalization of personal data processing should not imply that this processing must be carried out exclusively with digital means in all its phases when risks to the rights of individuals may arise.

Digitalization should mean an increase in the quality of the service provided and greater resilience and availability of the processing (art.32.1b of the GDPR). Both digitalizing and maintaining the possibility of carrying out processing in a non-digitized way is fully compatible at the same time. The digitalization of a processing, misunderstood as the total elimination of the possibility of non-digitized alternatives, at least in the phases of the processing in which the citizen intervenes, could violate the rights to non-discrimination and the capacity to act.

In regard with the violation of above rights in the framework of the implementation of the digitalization of processing of personal data, last years, an increase in the phenomena of exclusion of elderly people in a multitude of services now offered in digital form has been observed. The reasons may be several: lack of confidence, lack of devices or connection contracted to do so, lack of the necessary knowledge, or because they suffer some type of physical or cognitive deterioration that does not allow them to use the devices and interfaces. It must also be taken into account that planned obsolescence strategies continually change the interfaces and devices necessary to access these services, which implies an additional economic and learning burden.

In this context, elderly people are not an intrinsically vulnerable population. Elderly people are placed in a vulnerable situation when the providers of some services offer only digital versions of that services, in many cases eliminating the non-digitized options of previously existing processing. This may imply limitations in their relationship with public administrations, with the health system, with the financial system and banking, with cultural, entertainment and shopping services or with communication with other people. The difficulties that have been created for them to relate naturally, for example, with their doctor or pharmacy, with their bank or to make an appointment are notorious. It should also be taken into account that, by forcing elderly people to seek help from third parties to be able to carry out the digital procedures they need to have access to certain services, they are forced not only to lose autonomy, but also to reveal personal data, in many cases sensitive, to these people that they are helped by, for example, related to their health or financial situation. In short, it discriminates them and limits their ability to act.

In those cases, this processing implemented exclusively through digital means would not pass a judgment of necessity and suitability (art.6.1.b to 6.1.f and 9.2.b, c and f to j of the GDPR). To overcome it, processing must respond to certain deficiencies, demands, requirements, obligations or objective opportunities and demonstrate that it can achieve the proposed objectives with sufficient effectiveness. This judgment would not be overcome when there is an entire population group for which processing is not effective or suitable, since either they are directly excluded from them, or the effectiveness is reduced in their case because they must invest time, disproportionate effort and resources.

Rely on training or digital literacy plans for elderly people, no matter how useful and recommended they may be, is not a sufficient measure and it is not in accordance with the GDPR.

The obligation to comply fall on controllers and it cannot be shifted to the data subjects. The controllers have in their hands an organizational measure very effective: always offering a non-automated alternative to completely digitalized processing, accessible to elderly people autonomously.

Digitalization allows for more effective and efficient services, with obvious benefits in the context of personal data processing. However, digitalization should not imply the elimination of non-automated alternatives that guarantee non-discrimination, the ability to act, the suitability of the processing, the correct management of the risk, availability and resilience of processing, which affect both elderly people and other groups in which access to continuously changing devices and interfaces causes a possible violation of their rights.

This post is related with other material released by the AEPD’s Innovation and Technology Division, such us:

•    Protection of Minors on the Internet section
•    Risk management and impact assessment in personal data processing [jun2021]