Would WMF, being in the US, need to worry about this to any greater degree
than it worries about, say, Chinese publishing restrictions, or UK
"superinjunctions"?
On Jun 2, 2014 2:15 PM, "Mike Godwin" <mnemo...@gmail.com> wrote:
> Chris writes:
>
> > If as a private citizen in the EU you construct a card-file index of
> > newspaper cuttings (or any other kind of database) including personal
> > details about a group of individuals, you are becoming both a "data
> > processor" and "data controller".
>
> I think that's the plain meaning of the ECJ decision.
>
> > It would be hard to argue that a Wikipedia article or Wikidata entry
> does
> > not represent personal data in a retrievable form.
>
> I agree here too.
>
> > It would be an interesting question whether the Wikimedia Foundation or
> > individual Wikimedians were data processors and controllers. The court
> would
> > have to decide who was the "controller" of this data, if indeed there was
> > one.
>
> My intuition is that a European court, and certainly the ECJ, would be
> likely to hold either or both WMF and individual Wikimedians liable.
> No need to choose between one or the other, given the breadth of the
> definitions.
>
> > I don't believe Wikipedia could be a data controller as it has no legal
> > personality, and legal personality is quite difficult to acquire when you
> > set out to avoid acquiring it.
>
> On this point I must disagree.
>
> > However, even if my line of thinking is correct, I think Wikipedia's
> > existing policies wouldn't need much amendment. Processing of personal
> data
> > is allowed so long as it complies with the various duties on data
> > processors, e.g. being accurate and processed for a legitimate purpose.
>
> Accuracy is no defense! That's one of the chief lessons of the ECJ
> opinion. And building an encyclopedia is not named as "a legitimate
> purpose" by the ECJ. (If it were, all Google would have to do is
> revive its own experiment in encyclopedias, Knol, but this time give
> it a compatible Creative Commons license.)
>
> > We have quite a clear purpose in processing data - the provision of an
> > encyclopedia. We already limit ourselves to truthful and accurate
> coverage
> > of data subjects (e.g. the BLP policy); and we already have something
> > analogous to a public-interest test as to whether we process this data at
> > all (the notability principle).
>
> Google has a clear purpose too, and it was no defense. Plus, there is
> a public-interest argument in favor of eschewing the erasure of true,
> accurate public data that happens to be old.
>
> Plus, it must be said, Wikimedia Foundation is not well-positioned to
> litigate these issues again and again in Europe.
>
>
> --Mike
>
>
>
> On Mon, Jun 2, 2014 at 4:02 PM, Chris Keating
> <chriskeatingw...@gmail.com> wrote:
> >
> >
> >
> > On Fri, May 30, 2014 at 6:39 PM, Mike Godwin <mnemo...@gmail.com> wrote:
> >>
> >> Chris writes:
> >>
> >> > As I understand it, the "right to be forgotten" will only affect the
> >> > discoverability of content, rather than existence of content.
> >> >
> >> > So if we rely on a source which says that person X did Y many years
> ago,
> >> > and X succeeds in invoking their "right to be forgotten", then the
> >> > source
> >> > will no longer appear in search engine results. The source, whether
> >> > offline
> >> > or online, will continue to exist and will continue to be a valid
> >> > reference.
> >> >
> >> > My understanding may well be wrong, and if there is anything that
> >> > summarises this issue as it affects Wikimedians I would be really
> >> > interested to read it.
> >>
> >> Your understanding is essentially correct, as far as it goes. The ECJ
> >> (aka "Curia") opinion makes clear that the decision applies to search
> >> engines but not (yet) to the databases of source journals (such as The
> >> New York Times or the Guardian).
> >>
> >> But of course it can affect the work of Wikipedia editors and other
> >> Wikimedians looking for online sources if search engine results can be
> >> censored in this way. In addition, it seems possible that the ECJ
> >> opinion can be understood to apply to Wikipedia itself, which, while
> >> not a search engine, may qualify as a "controller" as that word is
> >> defined under Article 2 of Directive 95/46 of the European Parliament
> >> ("on the protection of individuals with regard to the processing of
> >> personal data and on the free movement of such data"). Look at these
> >> relevant definitions from the text of the ECJ opinion:
> >>
> >
> > Hi Mike - thanks for the reply! Having looked and thought about it in a
> bit
> > more depth, I am pretty sure that you're right and that a case can be
> made
> > this precedent will apply to Wikimedians and possibly the Wikimedia
> > Foundation.
> >
> > Whether that is something we need to worry about is another issue, but
> this
> > is my reasoning (obviously I'm not a lawyer, etc, and I doubt this post
> > contains anything you don't already know but it's a useful thought
> process
> > for me);
> >
> > If as a private citizen in the EU you construct a card-file index of
> > newspaper cuttings (or any other kind of database) including personal
> > details about a group of individuals, you are becoming both a "data
> > processor" and "data controller".
> >
> > This judgement determines that Google's indexing of information about an
> > individual is covered by the rules that apply to data processors and
> > controllers. Google argued that their work was not covered, a) because
> they
> > did not know the contents of their own data (it all being generated
> > algorithmically) and b) because the personal data was entirely
> intermingled
> > with non-personal data.
> >
> > It would be hard to argue that a Wikipedia article or Wikidata entry
> does
> > not represent personal data in a retrievable form.
> >
> > It would be an interesting question whether the Wikimedia Foundation or
> > individual Wikimedians were data processors and controllers. The court
> would
> > have to decide who was the "controller" of this data, if indeed there was
> > one. I imagine they would be hard to persuade that the data had no
> > "controller", and easy to persuade that the WMF's provision of technical
> > infrastructure which interprets the data and present it represented
> > "control" in the sense of 2d. Wikimedians might however jointly be
> > "controllers" if they played a particularly important role.
> >
> > I don't believe Wikipedia could be a data controller as it has no legal
> > personality, and legal personality is quite difficult to acquire when you
> > set out to avoid acquiring it.
> >
> > However, even if my line of thinking is correct, I think Wikipedia's
> > existing policies wouldn't need much amendment. Processing of personal
> data
> > is allowed so long as it complies with the various duties on data
> > processors, e.g. being accurate and processed for a legitimate purpose.
> >
> > We have quite a clear purpose in processing data - the provision of an
> > encyclopedia. We already limit ourselves to truthful and accurate
> coverage
> > of data subjects (e.g. the BLP policy); and we already have something
> > analogous to a public-interest test as to whether we process this data at
> > all (the notability principle).
> >
> > Regards,
> >
> > Chris
> >
> >
> >
> >
> >
> >>
> >> ------------
> >>
> >> Article 2 of Directive 95/46 states that ‘[f]or the purposes of
> >> this Directive:
> >>
> >> (a) “personal data” shall mean any information relating to an
> >> identified or identifiable natural person (“data subject”); an
> >> identifiable person is one who can be identified, directly or
> >> indirectly, in particular by reference to an identification number or
> >> to one or more factors specific to his physical, physiological,
> >> mental, economic, cultural or social identity;
> >>
> >> (b) “processing of personal data” (“processing”) shall mean any
> >> operation or set of operations which is performed upon personal data,
> >> whether or not by automatic means, such as collection, recording,
> >> organisation, storage, adaptation or alteration, retrieval,
> >> consultation, use, disclosure by transmission, dissemination or
> >> otherwise making available, alignment or combination, blocking,
> >> erasure or destruction;
> >>
> >> ...
> >>
> >> (d) “controller” shall mean the natural or legal person, public
> >> authority, agency or any other body which alone or jointly with others
> >> determines the purposes and means of the processing of personal data;
> >> where the purposes and means of processing are determined by national
> >> or Community laws or regulations, the controller or the specific
> >> criteria for his nomination may be designated by national or Community
> >> law;
> >>
> >> ...
> >>
> >> Article 9 of Directive 95/46, entitled ‘Processing of personal
> >> data and freedom of expression’, provides:
> >>
> >> ‘Member States shall provide for exemptions or derogations from the
> >> provisions of this Chapter, Chapter IV and Chapter VI for the
> >> processing of personal data carried out solely for journalistic
> >> purposes or the purpose of artistic or literary expression only if
> >> they are necessary to reconcile the right to privacy with the rules
> >> governing freedom of expression.’
> >>
> >> ---------------
> >>
> >> (Note that "processing of personal data" need not be done "by
> >> automatic means." I read this to mean that Wikipedia editors
> >> themselves may qualify as engaging in the "processing of personal
> >> data." And the definition of "controller" expressly includes a
> >> "natural ... person."
> >>
> >> Assuming that Member States would assert jurisdiction over Wikipedia
> >> (even though Wikipedia is hosted in the United States), could
> >> Wikipedia articles be defended under the "solely for journalistic
> >> purposes or the purpose of artistic or literary expression" language
> >> of Article 9 of the Directive? That language doesn't strike me as a
> >> very good fit for what Wikipedia does.
> >
> >
>
> _______________________________________________
> Wikimedia-l mailing list, guidelines at:
> https://meta.wikimedia.org/wiki/Mailing_lists/Guidelines
> Wikimedia-l@lists.wikimedia.org
> Unsubscribe: https://lists.wikimedia.org/mailman/listinfo/wikimedia-l,
> <mailto:wikimedia-l-requ...@lists.wikimedia.org?subject=unsubscribe>
_______________________________________________
Wikimedia-l mailing list, guidelines at:
https://meta.wikimedia.org/wiki/Mailing_lists/Guidelines
Wikimedia-l@lists.wikimedia.org
Unsubscribe: https://lists.wikimedia.org/mailman/listinfo/wikimedia-l,
<mailto:wikimedia-l-requ...@lists.wikimedia.org?subject=unsubscribe>
