I have a question about the European General Data Protection Regulation.
According to Article 13, one has to inform anyone whose personal data is collected:
- Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information: (...)
Article 14 might also be of relevance:
Where personal data have not been obtained from the data subject, the controller shall provide the data subject with the following information: (...)
Article 4 explains, what "personal data" means:
‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (...)
Suppose, someone publishes a book, a scientific paper or an article on a blog, where he's citing a post from Facebook/Twitter/StackExchange/etc. These cited posts are "personal data", because they can be related to their accounts, which are "online identifiers" according to Article 4 of the GDPR. Would he have to inform the authors of all the posts that he cited?