UK Court of Appeal: Estab­lish­ment and beha­vio­ral obser­va­ti­on wit­hin the mea­ning of Art. 3 GDPR

The Court of Appeal has allo­wed a UK-based Israe­li busi­ness­man to file a pri­va­cy lawsu­it against the U.S. pro­vi­der of a news web­site, in con­nec­tion with cri­ti­cal coverage of the plain­tiff by the web­site (Soria­no v. Foren­sic News LLC).

The dis­puted que­sti­on was whe­ther the pro­vi­der fell wit­hin the scope of the GDPR. The court ans­we­red this que­sti­on in the affir­ma­ti­ve, or more pre­cise­ly: it con­si­de­red this con­clu­si­on to be justi­fia­ble (“argu­able”), the thres­hold requi­red in the con­text of the proceedings.

On the one hand, it may be that a Branch in the sen­se of Art. 3(1)(a) GDPR exi­sted, name­ly – sur­pri­sin­gly – due to the fact that the news web­site is finan­ced via Patre­on and the offer of cor­re­spon­ding sub­scrip­ti­ons could con­sti­tu­te an estab­lish­ment (it would pro­bab­ly have been more appro­pria­te to exami­ne this under Art. 3(1)(a) GDPR, i.e. the ori­en­ta­ti­on of the offer):

96 It is very likely that the CJEU aut­ho­ri­ties on the mea­ning of “estab­lish­ment” in Arti­cle 4 of the Direc­ti­ve would gui­de a deci­si­on on the mea­ning of the same word in Arti­cle 3(1) of the GDPR. I con­si­der it argu­able that the defen­dants had an “estab­lish­ment” in the EU wit­hin that mea­ning at the mate­ri­al times. I share the doubts expres­sed by Arnold LJ when gran­ting per­mis­si­on to appeal on this point. Howe­ver, as Mr Cal­lus has empha­sis­ed, the aut­ho­ri­ties set a low bar, and all the clai­mant has to do at this sta­ge is to per­sua­de the court that it is not fan­ci­ful to think that his case cros­ses that low bar.

Reci­tal (23) sug­gests that a cri­ti­cal con­si­de­ra­ti­on here is whe­ther the data con­trol­ler or pro­ces­sor “envi­sa­ges offe­ring ser­vices to data sub­jects in one or more Mem­ber Sta­tes in the Uni­on”. On the evi­dence, the defen­dants did more than merely making their jour­na­lism acces­si­ble over the world wide web. They inten­ded to make their out­put avail­ab­le in the UK and EU, and suc­ce­e­ded in attrac­ting a more than mini­mal rea­dership. In due cour­se they express­ly soli­ci­ted sub­scrip­ti­ons from wit­hin the UK and EU, via the Patre­on plat­form. They suc­ce­e­ded in secu­ring three sub­scrip­ti­ons in ster­ling and three in Euros. This may be “mini­mal” acti­vi­ty but not­hing more is requi­red, accord­ing to the aut­ho­ri­ties. The offer and accep­t­ance of sub­scrip­ti­ons in the­se local cur­ren­ci­es is argu­ab­ly a “real and effec­ti­ve” acti­vi­ty that is “ori­en­ted” towards the UK and EU. Jay J said that the jour­na­li­stic endea­vor was not so ori­en­ted but that, as it seems to me, goes more to the sepa­ra­te que­sti­on of whe­ther the jour­na­li­stic pro­ces­sing com­p­lai­ned of argu­ab­ly took place “in the con­text of” the acti­vi­ties of an “estab­lish­ment”. That is not an issue on this appeal. The Judge did not deci­de it, and the defen­dants have not filed a respondent’s noti­ce see­king to uphold his deci­si­on on alter­na­ti­ve grounds.

98. the key issue under arti­cle 3(1), as I see it, is whe­ther the crea­ti­on and use of the Patre­on sub­scrip­ti­on faci­li­ty demon­stra­tes “sta­ble arran­ge­ments”. Jay J con­si­de­red it could not be said to do so, becau­se the sub­scrip­ti­ons could be can­ce­led at any time. I do not think the ans­wer is so clear. The­re does seem to be a set of “arran­ge­ments” here. The CJEU aut­ho­ri­ties pro­vi­de no cri­te­ria for deci­ding whe­ther a given arran­ge­ment is “sta­ble”. Unli­ke the Judge, I do not think the ans­wer is necessa­ri­ly depen­dent on what sub­scri­bers can do in princip­le, as oppo­sed to what hap­pens in fact. I see for­ce in Mr. Cal­lus’ sub­mis­si­on that, in the con­text of this online media publi­ca­ti­on, sub­scrip­ti­on arran­ge­ments of this kind should be view­ed as sta­ble in natu­re. The defen­dants’ evi­dence as to the fun­ding arran­ge­ments for Foren­sic News shows that sub­scrip­ti­ons are a major inco­me stream, con­tri­bu­ting some 85% of total inco­me. I stron­gly suspect that once estab­lished a sub­scrip­ti­on will tend to be main­tai­ned. Cer­tain­ly, the­re is no evi­dence to the contrary.

In addi­ti­on, a Beha­vio­ral obser­va­ti­on in the sen­se of Art. 3 (2) lit. b DSGVO:

… The mere fact that the defen­dants crea­ted a collec­tion of per­so­nal data rela­ting to the claimant’s beha­vi­or in the EU might not be enough. But what they are alle­ged to have done is to assem­ble, ana­ly­se, sort, and recon­fi­gu­re such data, and then publish the result in arti­cles inclu­ding (among others) one enti­t­led “The Wal­ter Soria­no files”. I think it is argu­able that tho­se acti­vi­ties fall wit­hin the mea­ning of “moni­to­ring”, and wit­hin the scope of the EDPB’s noti­ons of “beha­viou­ral ana­ly­sis and pro­filing”. It may be deba­t­a­ble whe­ther the noti­ons of tar­ge­ting or ori­en­ta­ti­on towards the EU app­ly in this con­text. Mr Cal­lus sub­mits that the EDPB is wrong about that. But if they do they are argu­ab­ly satis­fied by “sta­ble arran­ge­ments” as alrea­dy dis­cus­sed, which enab­le EU citi­zens to sub­scri­be in their local cur­ren­cy to recei­ve Foren­sic News’ jour­na­li­stic output.