A Right to Reasonable Inferences: Re-Thinking Data Protection Law in the Age of Big Data and AI

The advent of Big Data analytics and artificial intelligence (AI) has fundamentally altered the data processing landscape. The data-driven systems of today can make probabilistic inferences about individuals, predicting their characteristics, behaviors, and likely future actions. They are no longer restricted to using and collecting raw data. This paper argues that the core tenets of data protection law, particularly the EU's General Data Protection Regulation (GDPR), are inadequately equipped to address the novel risks posed by inferential analytics. While the GDPR provides a robust framework for raw data, its application to inferences remains ambiguous and underdeveloped. Through systematically examining the GDPR's rights and obligations and analyzing the ECJ's jurisprudence, this paper demonstrates that inferences frequently fall into a regulatory gray area. The current legal framework struggles with inferences' subjectivity, verifiability, and qualification as personal data. As a result, essential rights like access, rectification, and objection are frequently rendered useless. This paper proposes a paradigm shift: recognizing a distinct “right to reasonable inferences.” This right would consist of two core components: (1) a substantive principle requiring that inferences meet thresholds of acceptability, relevance, and reliability, and (2) a procedural right to contest inferences deemed unreasonable effectively. Finally, the paper suggests ways to strike a balance between the rights of data subjects and the legitimate interests of data controllers, addressing intellectual property and trade secrets law as a significant obstacle to such a right.