The Court of Appeal has allowed a UK-based Israeli businessman to file a privacy lawsuit against the U.S. provider of a news website, in connection with critical coverage of the plaintiff by the website (Soriano v. Forensic News LLC).
The disputed question was whether the provider fell within the scope of the GDPR. The court answered this question in the affirmative, or more precisely: it considered this conclusion to be justifiable (“arguable”), the threshold required in the context of the proceedings.
On the one hand, it may be that a Branch in the sense of Art. 3(1)(a) GDPR existed, namely – surprisingly – due to the fact that the news website is financed via Patreon and the offer of corresponding subscriptions could constitute an establishment (it would probably have been more appropriate to examine this under Art. 3(1)(a) GDPR, i.e. the orientation of the offer):
96 It is very likely that the CJEU authorities on the meaning of “establishment” in Article 4 of the Directive would guide a decision on the meaning of the same word in Article 3(1) of the GDPR. I consider it arguable that the defendants had an “establishment” in the EU within that meaning at the material times. I share the doubts expressed by Arnold LJ when granting permission to appeal on this point. However, as Mr Callus has emphasised, the authorities set a low bar, and all the claimant has to do at this stage is to persuade the court that it is not fanciful to think that his case crosses that low bar.
Recital (23) suggests that a critical consideration here is whether the data controller or processor “envisages offering services to data subjects in one or more Member States in the Union”. On the evidence, the defendants did more than merely making their journalism accessible over the world wide web. They intended to make their output available in the UK and EU, and succeeded in attracting a more than minimal readership. In due course they expressly solicited subscriptions from within the UK and EU, via the Patreon platform. They succeeded in securing three subscriptions in sterling and three in Euros. This may be “minimal” activity but nothing more is required, according to the authorities. The offer and acceptance of subscriptions in these local currencies is arguably a “real and effective” activity that is “oriented” towards the UK and EU. Jay J said that the journalistic endeavor was not so oriented but that, as it seems to me, goes more to the separate question of whether the journalistic processing complained of arguably took place “in the context of” the activities of an “establishment”. That is not an issue on this appeal. The Judge did not decide it, and the defendants have not filed a respondent’s notice seeking to uphold his decision on alternative grounds.
98. the key issue under article 3(1), as I see it, is whether the creation and use of the Patreon subscription facility demonstrates “stable arrangements”. Jay J considered it could not be said to do so, because the subscriptions could be canceled at any time. I do not think the answer is so clear. There does seem to be a set of “arrangements” here. The CJEU authorities provide no criteria for deciding whether a given arrangement is “stable”. Unlike the Judge, I do not think the answer is necessarily dependent on what subscribers can do in principle, as opposed to what happens in fact. I see force in Mr. Callus’ submission that, in the context of this online media publication, subscription arrangements of this kind should be viewed as stable in nature. The defendants’ evidence as to the funding arrangements for Forensic News shows that subscriptions are a major income stream, contributing some 85% of total income. I strongly suspect that once established a subscription will tend to be maintained. Certainly, there is no evidence to the contrary.
In addition, a Behavioral observation in the sense of Art. 3 (2) lit. b DSGVO:
… The mere fact that the defendants created a collection of personal data relating to the claimant’s behavior in the EU might not be enough. But what they are alleged to have done is to assemble, analyse, sort, and reconfigure such data, and then publish the result in articles including (among others) one entitled “The Walter Soriano files”. I think it is arguable that those activities fall within the meaning of “monitoring”, and within the scope of the EDPB’s notions of “behavioural analysis and profiling”. It may be debatable whether the notions of targeting or orientation towards the EU apply in this context. Mr Callus submits that the EDPB is wrong about that. But if they do they are arguably satisfied by “stable arrangements” as already discussed, which enable EU citizens to subscribe in their local currency to receive Forensic News’ journalistic output.