How to fulfill the General Data Protection Regulation (GDPR) in science

Question

Suppose, a scientist is planning to publish a paper that is about an algorithm which analyzes Wikipedia articles. I'm wondering, if the European General Data Protection Regulation would be relevant in that case.

According to Article 13, one has to inform anyone whose personal data is collected:

1. Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information: (...)

Article 4 explains, what "personal data" means:

‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (...)

(Source: http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679)

Wikipedia articles might contain personal data, because each one has an edit history that lists changes and who did them (User accounts or IP addresses). Therefore, each article can be related to "online identifiers" (such as the account or the IP) of its editors. Would the scientist - according to the GDPR - have to inform the editors of all the Wikipedia Articles that he has processed their personal data?

Answer 1

Would the scientist - according to the GDPR - have to inform the editors of all the Wikipedia Articles that he has processed their personal data?

No.

If you collect personal data from thousands of Wikipedia articles and not from editors directly, then you fall not under Article 13 but under Article 14 which also deals with informing data subjects but has special exception rule for scientific purposes which may be based on personal data of a large number of data subjects.

Article 14(5):

5. Paragraphs 1 to 4 shall not apply where and insofar as: (...) the provision of such information proves impossible or would involve a disproportionate effort, in particular for processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, subject to the conditions and safeguards referred to in Article 89(1) or in so far as the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriously impair the achievement of the objectives of that processing. In such cases the controller shall take appropriate measures to protect the data subject's rights and freedoms and legitimate interests, including making the information publicly available;