Article 6(3) AI Act provides that the filter mechanism may not be applied where an AI system performs profiling of natural persons. Article 3(52) AI Act defines the notion of profiling by cross-referring to Article 4(4) GDPR.
Pursuant to that provision, profiling is to be understood as any automated form of processing, which is carried out on personal data with the objective to ‘evaluate certain personal aspects’ relating to a natural person5. That definition consists of three cumulative elements:
there must be an automated form of processing;
which is carried out on personal data; and
the objective of which must be to evaluate personal aspects relating to a natural person.
It is only if all three conditions are fulfilled that an AI system classified as high-risk pursuant to Article 6(2) AI Act does not benefit from the exemptions listed in Article 6(3) AI Act. While the element of automated processing will always be fulfilled with regard to AI systems, providers must determine whether the data input of the system includes personal data and whether the system is intended to be used to evaluate personal aspects relating to a natural person. Such an evaluation is normally conduc ted with the purpose of analysing or predicting personal aspects, for instance concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements. In other words, profiling means the use of information about an individual (or group of individuals) and evaluating their characteristics or behaviour patterns in order to place them into a certain category or group, in particular to analyse, infer or make predictions about, for example, their ability to perform a task, interests, or likely behaviour6.
For example, AI system used by customs authorities to assess the risk of goods entering the EU for not complying with legislation applicable at the border on the basis of information about the economic operators related to goods (e.g. container number, description of goods, routing, transport, payment method). The processing is not evaluating personal aspects of a natural person, but assesses the risk of non-compliant consignments, hence such evaluation would not amount to profiling.
Where the personal data are not used to perform an evaluation of personal characteristics (which must always include a form of prediction, assessment or judgement) that evaluation will not constitute profiling7 . For instance, a simple classification of individuals based on personal characteristics such as their age, sex, and height does not necessarily lead to profiling. Whether an evaluation includes predictions or the drawing of conclusions will depend on the purpose of the classification8.
Example: An AI system is intended to be used in the context offor th recruitment of employees. The system is used to identify deviations from previous recruitment decision-making patterns before recruitment is compl eted (to detect potential inconsistencies and deviations from corporate recruitment policies), while evaluating the personal characteristics of the recruiters conducting the job interviews. Assessment: The evaluation of the recruiter’s decisions and their personal characteristics to analyse possible deviations from previous decision-making patterns constitutes profiling. While the use of the system could fall under point (c) of Article 6(3) AI Act, the fact that the system also involves the processing of personal data to profile recruiters means that the filter mechanism listed in that provision is not applicable.
- See also Article 29,Data Protection Working Party, Guidelines on Automated individual decision-making and Profiling for the purposes of Regulation 2016/679, WP251rev.01, 6.2.2018, p. 6and7, endorsedby the European Data Protection Board (EDPB).
- Para.154 of the Commission Guidelines on prohibited artificial intelligence practices established by Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Direct ives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act), Text with EEA relevance (OJ L, 2024/1689).
- See also Article 29 Data Protection Working Party, Guidelines on Automated individual decision-making and Profiling for the purposes of Regulation 2016/679, p. 6-7, endorsed by the EDPB.
- Article 29 Data Protection Working Party, Guidelines on Automated individual decision-making and Profiling for the purposes of Regulation 2016/679, p. 6-7, endorsed by the EDPB.