internet european-union gdpr
How to fulfill the General Data Protection Regulation (GDPR) in science
<p>Suppose, a scientist is planning to publish a paper that is about an algorithm which analyzes Wikipedia articles. I'm wondering, if the European General Data Protection Regulation would be relevant in that case.</p>

<p>According to Article 13, one has to inform anyone whose personal data is collected:</p>

<blockquote>
  <ol>
  <li>Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data
  are obtained, provide the data subject with all of the following
  information: (...)</li>
  </ol>
</blockquote>

<p>Article 4 explains, what "personal data" means:</p>

<blockquote>
  <p>‘personal data’ means any information relating to an identified or
  identifiable natural person (‘data subject’); an identifiable natural
  person is one who can be identified, directly or indirectly, in
  particular by reference to an identifier such as a name, an
  identification number, location data, an online identifier (...)</p>
</blockquote>

<p>(Source: <a href="http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679" rel="nofollow noreferrer">http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679</a>)</p>

<p>Wikipedia articles might contain personal data, because each one has an edit history that lists changes and who did them (User accounts or IP addresses). Therefore, each article can be related to "online identifiers" (such as the account or the IP) of its editors. Would the scientist - according to the GDPR - have to inform the editors of all the Wikipedia Articles that he has processed their personal data?</p>

<blockquote>
  <p>Would the scientist - according to the GDPR - have to inform the editors of all the Wikipedia Articles that he has processed their personal data?</p>
</blockquote>

<p><strong>No.</strong></p>

<p>If you collect personal data from <em>thousands</em> of Wikipedia articles and <em>not</em> from editors directly, then you fall not under Article 13 but under Article 14 which also deals with informing data subjects but has special exception rule for scientific purposes which may be based on personal data of a large number of data subjects.</p>

<p>Article 14(5):</p>

<blockquote>
  <ol start="5">
  <li>Paragraphs 1 to 4 shall not apply where and insofar as: (...) the provision of such information proves impossible or <strong>would involve a disproportionate effort</strong>, in particular for processing for archiving purposes in the public interest, <strong>scientific</strong> or historical research purposes or statistical purposes, subject to the conditions and safeguards referred to in Article 89(1) or in so far as the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriously impair the achievement of the objectives of that processing. In such cases the controller shall take appropriate measures to protect the data subject's rights and freedoms and legitimate interests, including making the information publicly available;</li>
  </ol>
</blockquote>
