14. What is meant by sensitive personal data or personality profiling within the context of the LIPAD?

According to article 4 (b and c), the law defines these notions as follows

Sensitive personal data: “personal data on religious, philosophical, political or trade union opinions or activities, health, intimate sphere or ethnicity, social assistance measures, criminal or administrative proceedings or sanctions.”

For example, if you ask a mother, what illness her child has, then you are processing (collecting) sensitive personal data. In other words, if you collect the diagnosis(es) (dyslexia, autism, diabetes, etc.) of a person (adult or minor) then you are processing (collecting) sensitive personal data.

Here is another example: if, in the context of a research project, you ask people about their religious practices, you are also processing (collecting) sensitive personal data under the LIPAD.

Consequence: an authorization request to the State Council (Conseil d’Etat) is necessary (see FAQ 15).

 

Personality profiling: “a collection of data allowing an assessment of the essential characteristics of a natural person.”

This notion remains vague and is not very operational. We sought to clarify this definition with the DPO, who sent us the definition of this concept in the new Federal Act on Data Protection (DPA – Article 5, letters f and g, dated June 7, 2022, this text has not yet been implemented):

• “f) profiling: any form of automated processing of personal data consisting in using such data to evaluate certain personal aspects relating to a natural person, particularly to analyse or predict aspects concerning work performance, economic situation, health, personal preferences, interests, reliability, behaviour, location or moving of the physical person.
• g) high-risk profiling: any profiling that entails a high risk to the personality or fundamental rights of the person of concern, since it leads to matching of data that allows the essential characteristics of the personality of a physical person to be assessed.”

For research, the CUREG considers that a research project deals with personality profiling when tools (quantitative or qualitative) are used that are based on scientific approaches to personality traits, and that allow the respondent to be described on several fundamental dimensions of their personality (e.g., profiling on the “Big Five” dimensions). In this case, the CUREG will invite the person in charge to contact the DPO to check with them whether steps with the State Council (Conseil d’Etat) are necessary (see FAQ 15). Measures of attitudes towards oneself (e.g., self-esteem), values (e.g., solidarity), or single personality traits (e.g., extraversion) are excluded.