Art. 6(1)(f). Content personalisation

Abstract

Given the reliance of content personalisation on personal data, data protection law can address some of the risks introduced by personalisation technologies. Since all forms of personal data processing require a legal basis, we argue below that content personalisation is only lawful if it does not manipulate individual behaviour or does not contribute to the erosion of the public sphere. Even if content personalisation meets these standards, data controllers must still observe certain requirements, such as data protection by design and by default, and provide data subjects with the rights protected by the GDPR. Not all individual and societal risks from content personalisation can be addressed by data protection law. In fact, many of the salient risks associated with tailored online environments – such as the impact of excessive personalisation on the public sphere – may persist even if the GDPR is scrupulously observed. Nevertheless, existing data protection law is a relevant instrument for preventing the misuse of content personalisation for manipulative, societal negative effects or otherwise unlawful purposes.