On Fri, May 30, 2014 at 6:39 PM, Mike Godwin <mnemo...@gmail.com> wrote:

> Chris writes:
>
> > As I understand it, the "right to be forgotten" will only affect the
> > discoverability of content, rather than existence of content.
> >
> > So if we rely on a source which says that person X did Y many years ago,
> > and X succeeds in invoking their "right to be forgotten", then the source
> > will no longer appear in search engine results. The source, whether
> offline
> > or online, will continue to exist and will continue to be a valid
> reference.
> >
> > My understanding may well be wrong, and if there is anything that
> > summarises this issue as it affects Wikimedians I would be really
> > interested to read it.
>
> Your understanding is essentially correct, as far as it goes. The ECJ
> (aka "Curia") opinion makes clear that the decision applies to search
> engines but not (yet) to the databases of source journals (such as The
> New York Times or the Guardian).
>
> But of course it can affect the work of Wikipedia editors and other
> Wikimedians looking for online sources if search engine results can be
> censored in this way. In addition, it seems possible that the ECJ
> opinion can be understood to apply to Wikipedia itself, which, while
> not a search engine, may qualify as a "controller" as that word is
> defined under Article 2 of Directive 95/46 of the European Parliament
> ("on the protection of individuals with regard to the processing of
> personal data and on the free movement of such data").  Look at these
> relevant definitions from the text of the ECJ opinion:
>
>
Hi Mike - thanks for the reply! Having looked and thought about it in a bit
more depth, I am pretty sure that you're right and that a case can be made
this precedent will apply to Wikimedians and possibly the Wikimedia
Foundation.

Whether that is something we need to worry about is another issue, but this
is my reasoning (obviously I'm not a lawyer, etc, and I doubt this post
contains anything you don't already know but it's a useful thought process
for me);

If as a private citizen in the EU you construct a card-file index of
newspaper cuttings (or any other kind of database) including personal
details about a group of individuals, you are becoming both a "data
processor" and "data controller".

This judgement determines that Google's indexing of information about an
individual is covered by the rules that apply to data processors and
controllers. Google argued that their work was not covered, a) because they
did not know the contents of their own data (it all being generated
algorithmically) and b) because the personal data was entirely intermingled
with non-personal data.

It would be hard to argue that a Wikipedia article  or Wikidata entry does
not represent personal data in a retrievable form.

It would be an interesting question whether the Wikimedia Foundation or
individual Wikimedians were data processors and controllers. The court
would have to decide who was the "controller" of this data, if indeed there
was one. I imagine they would be hard to persuade that the data had no
"controller", and easy to persuade that the WMF's provision of technical
infrastructure which interprets the data and present it represented
"control" in the sense of 2d. Wikimedians might however jointly be
"controllers" if they played a particularly important role.

I don't believe Wikipedia could be a data controller as it has no legal
personality, and legal personality is quite difficult to acquire when you
set out to avoid acquiring it.

 However, even if my line of thinking is correct, I think Wikipedia's
existing policies wouldn't need much amendment. Processing of personal data
is allowed so long as it complies with the various duties on data
processors, e.g. being accurate and processed for a legitimate purpose.

We have quite a clear purpose in processing data - the provision of an
encyclopedia. We already limit ourselves to truthful and accurate coverage
of data subjects (e.g. the BLP policy); and we already have something
analogous to a public-interest test as to whether we process this data at
all (the notability principle).

Regards,

Chris






> ------------
>
>     Article 2 of Directive 95/46 states that ‘[f]or the purposes of
> this Directive:
>
> (a)      “personal data” shall mean any information relating to an
> identified or identifiable natural person (“data subject”); an
> identifiable person is one who can be identified, directly or
> indirectly, in particular by reference to an identification number or
> to one or more factors specific to his physical, physiological,
> mental, economic, cultural or social identity;
>
> (b)       “processing of personal data” (“processing”) shall mean any
> operation or set of operations which is performed upon personal data,
> whether or not by automatic means, such as collection, recording,
> organisation, storage, adaptation or alteration, retrieval,
> consultation, use, disclosure by transmission, dissemination or
> otherwise making available, alignment or combination, blocking,
> erasure or destruction;
>
> ...
>
> (d)      “controller” shall mean the natural or legal person, public
> authority, agency or any other body which alone or jointly with others
> determines the purposes and means of the processing of personal data;
> where the purposes and means of processing are determined by national
> or Community laws or regulations, the controller or the specific
> criteria for his nomination may be designated by national or Community
> law;
>
> ...
>
>     Article 9 of Directive 95/46, entitled ‘Processing of personal
> data and freedom of expression’, provides:
>
> ‘Member States shall provide for exemptions or derogations from the
> provisions of this Chapter, Chapter IV and Chapter VI for the
> processing of personal data carried out solely for journalistic
> purposes or the purpose of artistic or literary expression only if
> they are necessary to reconcile the right to privacy with the rules
> governing freedom of expression.’
>
> ---------------
>
> (Note that "processing of personal data" need not be done "by
> automatic means." I read this to mean that Wikipedia editors
> themselves may qualify as engaging in the "processing of personal
> data." And the definition of "controller" expressly includes a
> "natural ... person."
>
> Assuming that Member States would assert jurisdiction over Wikipedia
> (even though Wikipedia is hosted in the United States), could
> Wikipedia articles be defended under the "solely for journalistic
> purposes or the purpose of artistic or literary expression" language
> of Article 9 of the Directive? That language doesn't strike me as a
> very good fit for what Wikipedia does.
_______________________________________________
Wikimedia-l mailing list, guidelines at: 
https://meta.wikimedia.org/wiki/Mailing_lists/Guidelines
Wikimedia-l@lists.wikimedia.org
Unsubscribe: https://lists.wikimedia.org/mailman/listinfo/wikimedia-l, 
<mailto:wikimedia-l-requ...@lists.wikimedia.org?subject=unsubscribe>

Reply via email to