[number6]

Profiling has to be done with acording to a privacy assesment analysis and can only be done if the assesment shows no elevated risks and / or the risks that exists are taken into account and contingencys are planed for.

Yes it is quite some work and overhead, but you are extracting information and use it in a way the person could not foresee or conceptualize even exists within the data.