On Fri, May 30, 2014 at 6:39 PM, Mike Godwin <mnemonic(a)gmail.com> wrote:
Chris writes:
As I understand it, the "right to be
forgotten" will only affect the
discoverability of content, rather than existence of content.
So if we rely on a source which says that person X did Y many years ago,
and X succeeds in invoking their "right to be forgotten", then the source
will no longer appear in search engine results. The source, whether
offline
or online, will continue to exist and will
continue to be a valid
reference.
My understanding may well be wrong, and if there is anything that
summarises this issue as it affects Wikimedians I would be really
interested to read it.
Your understanding is essentially correct, as far as it goes. The ECJ
(aka "Curia") opinion makes clear that the decision applies to search
engines but not (yet) to the databases of source journals (such as The
New York Times or the Guardian).
But of course it can affect the work of Wikipedia editors and other
Wikimedians looking for online sources if search engine results can be
censored in this way. In addition, it seems possible that the ECJ
opinion can be understood to apply to Wikipedia itself, which, while
not a search engine, may qualify as a "controller" as that word is
defined under Article 2 of Directive 95/46 of the European Parliament
("on the protection of individuals with regard to the processing of
personal data and on the free movement of such data"). Look at these
relevant definitions from the text of the ECJ opinion:
Hi Mike - thanks for the reply! Having looked and thought about it in a bit
more depth, I am pretty sure that you're right and that a case can be made
this precedent will apply to Wikimedians and possibly the Wikimedia
Foundation.
Whether that is something we need to worry about is another issue, but this
is my reasoning (obviously I'm not a lawyer, etc, and I doubt this post
contains anything you don't already know but it's a useful thought process
for me);
If as a private citizen in the EU you construct a card-file index of
newspaper cuttings (or any other kind of database) including personal
details about a group of individuals, you are becoming both a "data
processor" and "data controller".
This judgement determines that Google's indexing of information about an
individual is covered by the rules that apply to data processors and
controllers. Google argued that their work was not covered, a) because they
did not know the contents of their own data (it all being generated
algorithmically) and b) because the personal data was entirely intermingled
with non-personal data.
It would be hard to argue that a Wikipedia article or Wikidata entry does
not represent personal data in a retrievable form.
It would be an interesting question whether the Wikimedia Foundation or
individual Wikimedians were data processors and controllers. The court
would have to decide who was the "controller" of this data, if indeed there
was one. I imagine they would be hard to persuade that the data had no
"controller", and easy to persuade that the WMF's provision of technical
infrastructure which interprets the data and present it represented
"control" in the sense of 2d. Wikimedians might however jointly be
"controllers" if they played a particularly important role.
I don't believe Wikipedia could be a data controller as it has no legal
personality, and legal personality is quite difficult to acquire when you
set out to avoid acquiring it.
However, even if my line of thinking is correct, I think Wikipedia's
existing policies wouldn't need much amendment. Processing of personal data
is allowed so long as it complies with the various duties on data
processors, e.g. being accurate and processed for a legitimate purpose.
We have quite a clear purpose in processing data - the provision of an
encyclopedia. We already limit ourselves to truthful and accurate coverage
of data subjects (e.g. the BLP policy); and we already have something
analogous to a public-interest test as to whether we process this data at
all (the notability principle).
Regards,
Chris
------------
Article 2 of Directive 95/46 states that ‘[f]or the purposes of
this Directive:
(a) “personal data” shall mean any information relating to an
identified or identifiable natural person (“data subject”); an
identifiable person is one who can be identified, directly or
indirectly, in particular by reference to an identification number or
to one or more factors specific to his physical, physiological,
mental, economic, cultural or social identity;
(b) “processing of personal data” (“processing”) shall mean any
operation or set of operations which is performed upon personal data,
whether or not by automatic means, such as collection, recording,
organisation, storage, adaptation or alteration, retrieval,
consultation, use, disclosure by transmission, dissemination or
otherwise making available, alignment or combination, blocking,
erasure or destruction;
...
(d) “controller” shall mean the natural or legal person, public
authority, agency or any other body which alone or jointly with others
determines the purposes and means of the processing of personal data;
where the purposes and means of processing are determined by national
or Community laws or regulations, the controller or the specific
criteria for his nomination may be designated by national or Community
law;
...
Article 9 of Directive 95/46, entitled ‘Processing of personal
data and freedom of expression’, provides:
‘Member States shall provide for exemptions or derogations from the
provisions of this Chapter, Chapter IV and Chapter VI for the
processing of personal data carried out solely for journalistic
purposes or the purpose of artistic or literary expression only if
they are necessary to reconcile the right to privacy with the rules
governing freedom of expression.’
---------------
(Note that "processing of personal data" need not be done "by
automatic means." I read this to mean that Wikipedia editors
themselves may qualify as engaging in the "processing of personal
data." And the definition of "controller" expressly includes a
"natural ... person."
Assuming that Member States would assert jurisdiction over Wikipedia
(even though Wikipedia is hosted in the United States), could
Wikipedia articles be defended under the "solely for journalistic
purposes or the purpose of artistic or literary expression" language
of Article 9 of the Directive? That language doesn't strike me as a
very good fit for what Wikipedia does.