The Protection of Individuals Against Privacy-Invasive and Discriminatory Inferences Under European Law: From the General Data Protection Regulation and the Digital Content and Services Directive to the Artificial Intelligence Act

Inferences are information relating to an identified or identifiable natural person generated using machine learning techniques, allowing probabilistic correlations between input data to be discovered and predictions made in new cases. Inferences carry many risks: they are inherently uncertain, predictions are only as reliable as the data on which they are based, and inferences can be used to nudge and manipulate individuals. It is essential to prevent these risks, and where they materialise, provide appropriate protection. This paper examines whether current European legislation adequately addresses these issues. The first task is to classify inferences to determine whether they fall within the concept of personal data and are this covered by European personal data laws. This analysis considers both possibilities – treating inferences as personal and non-personal data – and evaluates the relevant regulatory frameworks, including the General Data Protection Regulation, the Proposal for a Regulation on Privacy and Electronic Communications, Digital Content and Services Directive, and the Artificial Intelligence Act.