gdpr
How to fulfill the General Data Protection Regulation (GDPR) when citing
<p>I have a question about the European General Data Protection Regulation.</p>

<p>According to Article 13, one has to inform anyone whose personal data is collected:</p>

<blockquote>
  <ol>
  <li>Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data
  are obtained, provide the data subject with all of the following
  information: (...)</li>
  </ol>
</blockquote>

<p>Article 14 might also be of relevance:</p>

<blockquote>
  <p>Where personal data have not been obtained from the data subject, the
  controller shall provide the data subject with the following
  information: (...)</p>
</blockquote>

<p>Article 4 explains, what "personal data" means:</p>

<blockquote>
  <p>‘personal data’ means any information relating to an identified or
  identifiable natural person (‘data subject’); an identifiable natural
  person is one who can be identified, directly or indirectly, in
  particular by reference to an identifier such as a name, an
  identification number, location data, an online identifier (...)</p>
</blockquote>

<p>(Source: <a href="http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679" rel="nofollow noreferrer">http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679</a>)</p>

<p>Suppose, someone publishes a book, a scientific paper or an article on a blog, where he's citing a post from Facebook/Twitter/StackExchange/etc. These cited posts are "personal data", because they can be related to their accounts, which are "online identifiers" according to Article 4 of the GDPR. Would he have to inform the authors of all the posts that he cited?</p>

<p>Taken literally, Article 14 would seem to apply in this case, and would mandate notifying persons whose work is being cited of this fact, although that might have significant practical problems.</p>

<p>But <a href="https://gdpr-info.eu/art-85-gdpr/" rel="nofollow noreferrer">Article 85</a> section 2 says:</p>

<blockquote>
  <p>For processing carried out for journalistic purposes or the purpose of academic artistic or literary expression, Member States shall provide for exemptions or derogations from Chapter II (principles), Chapter III (rights of the data subject), Chapter IV (controller and processor), Chapter V (transfer of personal data to third countries or international organisations), Chapter VI (independent supervisory authorities), Chapter VII (cooperation and consistency) and Chapter IX (specific data processing situations) if they are necessary to reconcile the right to the protection of personal data with the freedom of expression and information.</p>
</blockquote>

<p>Recital 153 says:</p>

<blockquote>
  <p>The processing of personal data solely for journalistic purposes, or for the purposes of academic, artistic or literary expression should be subject to derogations or exemptions from certain provisions of this Regulation if necessary to reconcile the right to the protection of personal data with the right to freedom of expression and information, as enshrined in Article 11 of the Charter ... In order to take account of the importance of the right to freedom of expression in every democratic society, it is necessary to interpret notions relating to that freedom, such as journalism, broadly.</p>
</blockquote>

<p>That should mean that processing for such "journalistic purposes", which surely should include publishing an academic work and citing statements in such a work, would be exempt from at least some of the requirements. However, the exact nature of the exemption will be a matter for the law of each member nation, and they may differ. The question does not state in which member nation the citation and publication occurs.</p>

<p>So I suspect that such notification is not required, but I cannot be sure of this.</p>
