5

I have a question about the European General Data Protection Regulation.

According to Article 13, one has to inform anyone whose personal data is collected:

  1. Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information: (...)

Article 14 might also be of relevance:

Where personal data have not been obtained from the data subject, the controller shall provide the data subject with the following information: (...)

Article 4 explains, what "personal data" means:

‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (...)

(Source: http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679)

Suppose, someone publishes a book, a scientific paper or an article on a blog, where he's citing a post from Facebook/Twitter/StackExchange/etc. These cited posts are "personal data", because they can be related to their accounts, which are "online identifiers" according to Article 4 of the GDPR. Would he have to inform the authors of all the posts that he cited?

Improve this question
2
  • Article 13 does not apply in this case, because you don't collect data directly from the subject. Instead Article 14 applies, because you obtain the data from a third party (Facebook/Twitter/StackExchange/etc). But your question remains valid.
    – wimh
    Aug 30, 2018 at 20:06
  • Art 85.2 would come into play here.
    – Polygnome
    Sep 1, 2018 at 13:20

1 Answer 1

Reset to default
2

Taken literally, Article 14 would seem to apply in this case, and would mandate notifying persons whose work is being cited of this fact, although that might have significant practical problems.

But Article 85 section 2 says:

For processing carried out for journalistic purposes or the purpose of academic artistic or literary expression, Member States shall provide for exemptions or derogations from Chapter II (principles), Chapter III (rights of the data subject), Chapter IV (controller and processor), Chapter V (transfer of personal data to third countries or international organisations), Chapter VI (independent supervisory authorities), Chapter VII (cooperation and consistency) and Chapter IX (specific data processing situations) if they are necessary to reconcile the right to the protection of personal data with the freedom of expression and information.

Recital 153 says:

The processing of personal data solely for journalistic purposes, or for the purposes of academic, artistic or literary expression should be subject to derogations or exemptions from certain provisions of this Regulation if necessary to reconcile the right to the protection of personal data with the right to freedom of expression and information, as enshrined in Article 11 of the Charter ... In order to take account of the importance of the right to freedom of expression in every democratic society, it is necessary to interpret notions relating to that freedom, such as journalism, broadly.

That should mean that processing for such "journalistic purposes", which surely should include publishing an academic work and citing statements in such a work, would be exempt from at least some of the requirements. However, the exact nature of the exemption will be a matter for the law of each member nation, and they may differ. The question does not state in which member nation the citation and publication occurs.

So I suspect that such notification is not required, but I cannot be sure of this.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .