Abstract

https://ssrn.com/abstract=2733115
 


 



Singling Out People Without Knowing Their Names – Behavioural Targeting, Pseudonymous Data, and the New Data Protection Regulation


Frederik J. Zuiderveen Borgesius


University of Amsterdam - IViR Institute for Information Law (IViR)

February 16, 2016


Abstract:     
Information about millions of people is collected for behavioural targeting, a type of marketing that involves tracking people’s online behaviour for targeted advertising. It is hotly debated whether data protection law applies to behavioural targeting. Many behavioural targeting companies say that, as long as they do not tie names to data they hold about individuals, they do not process any personal data, and that, therefore, data protection law does not apply to them. European Data Protection Authorities, however, take the view that a company processes personal data if it uses data to single out a person, even if it cannot tie a name to these data. This paper argues that data protection law should indeed apply to behavioural targeting. Companies can often tie a name to nameless data about individuals. Furthermore, behavioural targeting relies on collecting information about individuals, singling out individuals, and targeting ads to individuals. Many privacy risks remain, regardless of whether companies tie a name to the information they hold about a person. A name is merely one of the identifiers that can be tied to data about a person, and it is not even the most practical identifier for behavioural targeting. Seeing data used to single out a person as personal data fits the rationale for data protection law: protecting fairness and privacy.

Number of Pages in PDF File: 40

Keywords: Pseudonymous data, data protection law, personal data, privacy, online behavioral advertising, behavioral targeting, profiling, cookie, IP address, tracking

JEL Classification: K12, K00, D10, D11, D20, D30, D40, D60, D70, L00, L11, L20, L51


Open PDF in Browser Download This Paper

Date posted: February 18, 2016  

Suggested Citation

Zuiderveen Borgesius, Frederik J., Singling Out People Without Knowing Their Names – Behavioural Targeting, Pseudonymous Data, and the New Data Protection Regulation (February 16, 2016). Available at SSRN: https://ssrn.com/abstract=2733115 or http://dx.doi.org/10.2139/ssrn.2733115

Contact Information

Frederik J. Zuiderveen Borgesius (Contact Author)
University of Amsterdam - IViR Institute for Information Law (IViR) ( email )
Amsterdam
Netherlands
HOME PAGE: http://www.ivir.nl/medewerkerpagina/zuiderveenborgesius?lang=en
Feedback to SSRN


Paper statistics
Abstract Views: 3,011
Downloads: 599
Download Rank: 33,778