UK Court of Appeal: Estab­lish­ment and beha­vi­oral obser­va­ti­on within the mea­ning of Art. 3 GDPR

The Court of Appeal has allo­wed a UK-based Israe­li busi­ness­man to file a pri­va­cy lawsu­it against the U.S. pro­vi­der of a news web­site, in con­nec­tion with cri­ti­cal covera­ge of the plain­ti­ff by the web­site (Soria­no v. Foren­sic News LLC).

The dis­pu­ted que­sti­on was whe­ther the pro­vi­der fell within the scope of the GDPR. The court ans­we­red this que­sti­on in the affir­ma­ti­ve, or more pre­cis­e­ly: it con­side­red this con­clu­si­on to be justi­fia­ble (“arguable”), the thres­hold requi­red in the con­text of the proceedings.

On the one hand, it may be that a Branch in the sen­se of Art. 3(1)(a) GDPR exi­sted, name­ly – sur­pri­sin­gly – due to the fact that the news web­site is finan­ced via Patre­on and the offer of cor­re­spon­ding sub­scrip­ti­ons could con­sti­tu­te an estab­lish­ment (it would pro­ba­b­ly have been more appro­pria­te to exami­ne this under Art. 3(1)(a) GDPR, i.e. the ori­en­ta­ti­on of the offer):

96 It is very likely that the CJEU aut­ho­ri­ties on the mea­ning of “estab­lish­ment” in Artic­le 4 of the Direc­ti­ve would gui­de a decis­i­on on the mea­ning of the same word in Artic­le 3(1) of the GDPR. I con­sider it arguable that the defen­dants had an “estab­lish­ment” in the EU within that mea­ning at the mate­ri­al times. I share the doubts expres­sed by Arnold LJ when gran­ting per­mis­si­on to appeal on this point. Howe­ver, as Mr Cal­lus has empha­sis­ed, the aut­ho­ri­ties set a low bar, and all the clai­mant has to do at this stage is to per­sua­de the court that it is not fan­ciful to think that his case crosses that low bar.

Reci­tal (23) sug­gests that a cri­ti­cal con­side­ra­ti­on here is whe­ther the data con­trol­ler or pro­ces­sor “envi­sa­ges offe­ring ser­vices to data sub­jects in one or more Mem­ber Sta­tes in the Uni­on”. On the evi­dence, the defen­dants did more than mere­ly making their jour­na­lism acce­s­si­ble over the world wide web. They inten­ded to make their out­put available in the UK and EU, and suc­ce­e­ded in attrac­ting a more than mini­mal rea­der­ship. In due cour­se they express­ly soli­ci­ted sub­scrip­ti­ons from within the UK and EU, via the Patre­on plat­form. They suc­ce­e­ded in secu­ring three sub­scrip­ti­ons in ster­ling and three in Euros. This may be “mini­mal” acti­vi­ty but not­hing more is requi­red, accor­ding to the aut­ho­ri­ties. The offer and accep­tance of sub­scrip­ti­ons in the­se local cur­ren­ci­es is argu­ab­ly a “real and effec­ti­ve” acti­vi­ty that is “ori­en­ted” towards the UK and EU. Jay J said that the jour­na­li­stic endea­vor was not so ori­en­ted but that, as it seems to me, goes more to the sepa­ra­te que­sti­on of whe­ther the jour­na­li­stic pro­ce­s­sing com­plai­ned of argu­ab­ly took place “in the con­text of” the acti­vi­ties of an “estab­lish­ment”. That is not an issue on this appeal. The Judge did not deci­de it, and the defen­dants have not filed a respondent’s noti­ce see­king to uphold his decis­i­on on alter­na­ti­ve grounds.

98. the key issue under artic­le 3(1), as I see it, is whe­ther the crea­ti­on and use of the Patre­on sub­scrip­ti­on faci­li­ty demon­stra­tes “sta­ble arran­ge­ments”. Jay J con­side­red it could not be said to do so, becau­se the sub­scrip­ti­ons could be can­ce­led at any time. I do not think the ans­wer is so clear. The­re does seem to be a set of “arran­ge­ments” here. The CJEU aut­ho­ri­ties pro­vi­de no cri­te­ria for deci­ding whe­ther a given arran­ge­ment is “sta­ble”. Unli­ke the Judge, I do not think the ans­wer is neces­s­a­ri­ly depen­dent on what sub­scri­bers can do in prin­ci­ple, as oppo­sed to what hap­pens in fact. I see force in Mr. Cal­lus’ sub­mis­si­on that, in the con­text of this online media publi­ca­ti­on, sub­scrip­ti­on arran­ge­ments of this kind should be view­ed as sta­ble in natu­re. The defen­dants’ evi­dence as to the fun­ding arran­ge­ments for Foren­sic News shows that sub­scrip­ti­ons are a major inco­me stream, con­tri­bu­ting some 85% of total inco­me. I stron­gly suspect that once estab­lished a sub­scrip­ti­on will tend to be main­tai­ned. Cer­tain­ly, the­re is no evi­dence to the contrary.

In addi­ti­on, a Beha­vi­oral obser­va­ti­on in the sen­se of Art. 3 (2) lit. b DSGVO:

… The mere fact that the defen­dants crea­ted a coll­ec­tion of per­so­nal data rela­ting to the claimant’s beha­vi­or in the EU might not be enough. But what they are alle­ged to have done is to assem­ble, ana­ly­se, sort, and recon­fi­gu­re such data, and then publish the result in artic­les inclu­ding (among others) one entit­led “The Wal­ter Soria­no files”. I think it is arguable that tho­se acti­vi­ties fall within the mea­ning of “moni­to­ring”, and within the scope of the EDPB’s noti­ons of “beha­viou­ral ana­ly­sis and pro­fil­ing”. It may be debata­ble whe­ther the noti­ons of tar­ge­ting or ori­en­ta­ti­on towards the EU app­ly in this con­text. Mr Cal­lus sub­mits that the EDPB is wrong about that. But if they do they are argu­ab­ly satis­fied by “sta­ble arran­ge­ments” as alre­a­dy dis­cus­sed, which enable EU citi­zens to sub­scri­be in their local cur­ren­cy to recei­ve Foren­sic News’ jour­na­li­stic output.




Rela­ted articles