copyright gdpr european-union creative-commons attribution
Creative commons attribution and GDPR
<p>When using content released under an open licence such as creative commons, it might be required to provide attribution to the author.</p>
<p>For instance, if I were to use <a href="https://commons.m.wikimedia.org/wiki/File:Tower_Bridge_from_Shad_Thames.jpg#mw-jump-to-license" rel="nofollow noreferrer">this image from Wikimedia Commons released under CC 4.0 BY-SA</a>, I would be required to specify the username for the creator, as part of the attribution.</p>
<p>However, according to GDPR, usernames are identifiable information.</p>
<p>Does that mean that there are privacy implications in attributing the content? Or is the dealing of the information for the purpose of attribution fair and proper because the creator set a specifically open licence with attribution?</p>

<p>Under <a href="https://gdpr-info.eu/art-6-gdpr/" rel="nofollow noreferrer">GDPR article 6</a> paragraph 1 item (c) one lawful basis for processing personal information (PI) is:</p>
<blockquote>
<p>processing is necessary for compliance with a legal obligation to which the controller is subject;</p>
</blockquote>
<p>The obligation to attribute a reused work under a CC license is such an obligation.  Moreover, the licensor has the option under any CC license to specify a pseudonym for attribution of that work, or to waive attribution totally. Not doing that while releasing content under a CC license that requires attribution could reasonably be considered consent to publish that name along with each re-released copy of the work, so there are at least two lawful bases for processing that name and making it public.</p>
<p>In some jurisdictions the license has the status of a contract, which imposes an obligation to attribute the author properly under GDPR Article 6 paragraph 3, as described in more detail in the answer by amon.</p>
<p>Also, usernames are PI <strong>if and only if</strong> it is reasonably possible to associate them with a specific natural person. If a person chose a user name for a single site, not used for any other, and did not post any info that allows the person's identity to be determined, it is not PI. Often, of course, the person can be determined.</p>

<p>Just because something is personal data doesn't mean you're prohibited from using/sharing/processing that personal data. You just need an Art 6 GDPR legal basis.</p>
<p>Here, the copyright holder is offering you a contract: you're allowed to freely use that image, as long as you attribute them properly. Since this attribution is necessary for fulfilling the license condition, you have a legal basis per Art 6(1)(b):</p>
<blockquote>
<p>(1) Processing shall lawful [if] (b) processing is necessary for the performance of a contract to which the data subject is party […]</p>
</blockquote>
<p>Furthermore, many copyright laws recognize moral rights: the right of the creator to be recognized for their creative works. This implies an attribution requirement, regardless of what the license says. So this attribution could also be argued to be necessary for compliance with your legal obligations, which is a legal basis under Art 6(1)(c).</p>
<p>Similar arguments could be made that the copyright holder has given their implicit <em>consent</em>, or that you have a <em>legitimate interest</em> in demonstrating the provenance of this image.</p>
<p>So are there privacy implications with attribution? Yes, absolutely. This is personal data, so you need to process it in accordance with the GDPR. However, the GDPR will not prevent you from fulfilling your contractual or legal obligations.</p>
