Re: Tearing ourselves away from endless Brexit analysis for a moment
@Seajay: don't get too excited! The new anti-profiling rules are just a recycled version of the old Directive rules (cf section 12 Data Protection Act 1998). Just like the so-called "right to be forgotten" is just the recycled right to erasure (cf section 10 DPA). Plus ca change on the rules.
Remember: nothing has been suddenly made illegal - in fact all data processing has been illegal by default (ie unless you can justify it) since 1995. Indeed that's the British way, not just the EU way (just look at Copyright Designs and Patents Act 1988), as my US intellectual property lecturer sardonically put it years ago. On top of that, look at British Gas' excuse "it was our computer wot done it not us guv!" in Ferguson v British Gas, one of the funniest Court of Appeal judgments I saw last decade.
On your specific query, it's quite simple. Part of what you have to do to legitimize use of profiling algorithms is to disclose to your customers the substance of what the algorithms do (see for example Article 13). As someone working on profiling algorithms for "big data" decades before it was called that, I heartily endorse this approach.
The real differences are: now they'll be enforced. And everyone and his dog can enforce them. And now the fines are existential. At last people will be dragged kicking and screaming into the late 20th century...
And don't worry about startups. The GDPR will supercharge the internet of things by (inadvertently) destroying all the barriers to competition in that field. I leave it as an exercise for you to work out how... :).
Biting the hand that feeds IT
