[discuss] Applying the Right To Be Forgotten to Wikipedia

Fri May 30 17:58:34 UTC 2014

(I've been sharing this in various mailing lists.)

I've been thinking about how the ECJ opinion might apply to an
enterprise like Wikipedia. A recent request for information on the
Wikimedia general mailing list gave me an excuse to revisit the
opinion in light of how it might apply to Wikipedia (and perhaps other
Wikimedia projects).

---------- Forwarded message ----------
From: Mike Godwin <mnemonic at gmail.com>
Date: Fri, May 30, 2014 at 1:39 PM
Subject: Applying the Right to Be Forgotten to Wikipedia (Was Re:
[Wikimedia-l] Right to be forgotten)
To: Wikimedia Mailing List <wikimedia-l at lists.wikimedia.org>

Chris writes:

> As I understand it, the "right to be forgotten" will only affect the
> discoverability of content, rather than existence of content.
>
> So if we rely on a source which says that person X did Y many years ago,
> and X succeeds in invoking their "right to be forgotten", then the source
> will no longer appear in search engine results. The source, whether offline
> or online, will continue to exist and will continue to be a valid reference.
>
> My understanding may well be wrong, and if there is anything that
> summarises this issue as it affects Wikimedians I would be really
> interested to read it.

Your understanding is essentially correct, as far as it goes. The ECJ
(aka "Curia") opinion makes clear that the decision applies to search
engines but not (yet) to the databases of source journals (such as The
New York Times or the Guardian).

But of course it can affect the work of Wikipedia editors and other
Wikimedians looking for online sources if search engine results can be
censored in this way. In addition, it seems possible that the ECJ
opinion can be understood to apply to Wikipedia itself, which, while
not a search engine, may qualify as a "controller" as that word is
defined under Article 2 of Directive 95/46 of the European Parliament
("on the protection of individuals with regard to the processing of
personal data and on the free movement of such data"). Look at these
relevant definitions from the text of the ECJ opinion:

------------

Article 2 of Directive 95/46 states that ‘[f]or the purposes of
this Directive:

(a) “personal data” shall mean any information relating to an
identified or identifiable natural person (“data subject”); an
identifiable person is one who can be identified, directly or
indirectly, in particular by reference to an identification number or
to one or more factors specific to his physical, physiological,
mental, economic, cultural or social identity;

(b) “processing of personal data” (“processing”) shall mean any
operation or set of operations which is performed upon personal data,
whether or not by automatic means, such as collection, recording,
organisation, storage, adaptation or alteration, retrieval,
consultation, use, disclosure by transmission, dissemination or
otherwise making available, alignment or combination, blocking,
erasure or destruction;

...

(d) “controller” shall mean the natural or legal person, public
authority, agency or any other body which alone or jointly with others
determines the purposes and means of the processing of personal data;
where the purposes and means of processing are determined by national
or Community laws or regulations, the controller or the specific
criteria for his nomination may be designated by national or Community
law;

...

Article 9 of Directive 95/46, entitled ‘Processing of personal
data and freedom of expression’, provides:

‘Member States shall provide for exemptions or derogations from the
provisions of this Chapter, Chapter IV and Chapter VI for the
processing of personal data carried out solely for journalistic
purposes or the purpose of artistic or literary expression only if
they are necessary to reconcile the right to privacy with the rules
governing freedom of expression.’

---------------

(Note that "processing of personal data" need not be done "by
automatic means." I read this to mean that Wikipedia editors
themselves may qualify as engaging in the "processing of personal
data." And the definition of "controller" expressly includes a
"natural ... person.")

Assuming that Member States would assert jurisdiction over Wikipedia
(even though Wikipedia is hosted in the United States), could
Wikipedia articles be defended under the "solely for journalistic
purposes or the purpose of artistic or literary expression" language
of Article 9 of the Directive? That language doesn't strike me as a
very good fit for what Wikipedia does.

The English-language version of the full text of the opinion is here:

http://curia.europa.eu/juris/document/document.jsf?text=&docid=152065&pageIndex=0&doclang=EN&mode=req&dir=&occ=first&part=1&cid=95716

Ilario writes:

> But I think that something will change for users writing content (no more
> references in the main search engine) but also to discover copyright
> infringements.

And, possibly much more than that, as I suggest above.

Not impossibly, and assuming EU can establish jurisdiction of
Wikimedia Foundation or its agents or its volunteer editors, this
particular news story might have turned out differently:
http://www.nytimes.com/2009/11/13/us/13wiki.html?_r=0 .

--Mike

-- 
Mike Godwin | Senior Legal Advisor, Global Internet Policy Project
mgodwin at internews.org | Mobile 415-793-4446
Skype mnemonic1026
Address 1640 Rhode Island Ave. NW, 7th Floor Washington, DC 20036 USA

INTERNEWS | Local Voices. Global Change.
www.internews.org | @internews | facebook.com/internews

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 495 bytes
Desc: Message signed with OpenPGP using GPGMail
URL: <http://1net-mail.1net.org/pipermail/discuss/attachments/20140530/e5be174b/signature.asc>