Takea­ways (AI):
  • Das Court of Appeal erlaubt einer Kla­ge eines israe­li­schen Geschäfts­manns gegen einen US-Anbie­ter von News.
  • Fra­ge des DSGVO-Anwen­dungs­be­reichs wird bejaht; der Anbie­ter könn­te eine Nie­der­las­sung in der EU haben.
  • Die Nut­zung von Patre­on zeigt, dass der Anbie­ter aktiv Abon­nen­ten in der UK und EU anwirbt.
  • Die Ana­ly­se von Nut­zer­da­ten könn­te als Ver­hal­tens­be­ob­ach­tung im Sin­ne der DSGVO inter­pre­tiert werden.

Das Court of Appeal hat einem in UK ansäs­si­gen israe­li­schen Geschäfts­mann erlaubt, eine daten­schutz­recht­li­che Kla­ge gegen den US-ame­ri­ka­ni­schen Anbie­ter einer News-Web­site ein­zu­rei­chen, dies im Zusam­men­hang mit einer kri­ti­schen Bericht­erstat­tung der Web­site über den Klä­ger (Soria­no vs. Foren­sic News LLC).

Strit­tig war die Fra­ge, ob der Anbie­ter in den Anwen­dungs­be­reich der DSGVO fiel. Das Gericht hat die­se Fra­ge bejaht, oder genau­er: Es hielt die­sen Schluss für ver­tret­bar (“arguable”), die im Rah­men des Ver­fah­rens erfor­der­li­che Schwelle.

Zum einen kann es sein, dass eine Nie­der­las­sung i.S.v. Art. 3 Abs. 1 lit. a DSGVO bestand, und zwar – über­ra­schen­der­wei­se – auf­grund der Tat­sa­che, dass sich die News-Web­site über Patre­on finan­ziert und das Ange­bot ent­spre­chen­der Abon­nen­te eine Nie­der­las­sung dar­stel­len könn­te (es wäre wohl näher gele­gen, dies unter Art. 3 Abs. 1 lit. a DSGVO zu prü­fen, also der Angebotsausrichtung):

96. It is very likely that the CJEU aut­ho­ri­ties on the mea­ning of “estab­lish­ment” in Artic­le 4 of the Direc­ti­ve would gui­de a decis­i­on on the mea­ning of the same word in Artic­le 3(1) of the GDPR. I con­sider it arguable that the defen­dants had an “estab­lish­ment” in the EU within that mea­ning at the mate­ri­al times. I share the doubts expres­sed by Arnold LJ when gran­ting per­mis­si­on to appeal on this point. Howe­ver, as Mr Cal­lus has empha­sis­ed, the aut­ho­ri­ties set a low bar, and all the clai­mant has to do at this stage is to per­sua­de the court that it is not fan­ciful to think that his case crosses that low bar.

97. Reci­tal (23) sug­gests that a cri­ti­cal con­side­ra­ti­on here is whe­ther the data con­trol­ler or pro­ces­sor “envi­sa­ges offe­ring ser­vices to data sub­jects in one or more Mem­ber Sta­tes in the Uni­on”. On the evi­dence, the defen­dants did more than mere­ly making their jour­na­lism acce­s­si­ble over the world wide web. They inten­ded to make their out­put available in the UK and EU, and suc­ce­e­ded in attrac­ting a more than mini­mal rea­der­ship. In due cour­se they express­ly soli­ci­ted sub­scrip­ti­ons from within the UK and EU, via the Patre­on plat­form. They suc­ce­e­ded in secu­ring three sub­scrip­ti­ons in ster­ling and three in Euros. This may be “mini­mal” acti­vi­ty but not­hing more is requi­red, accor­ding to the aut­ho­ri­ties. The offer and accep­tance of sub­scrip­ti­ons in the­se local cur­ren­ci­es is argu­ab­ly a “real and effec­ti­ve” acti­vi­ty that is “ori­en­ted” towards the UK and EU. Jay J said that the jour­na­li­stic endea­vour was not so ori­en­ted but that, as it seems to me, goes more to the sepa­ra­te que­sti­on of whe­ther the jour­na­li­stic pro­ce­s­sing com­plai­ned of argu­ab­ly took place “in the con­text of” the acti­vi­ties of an “estab­lish­ment”. That is not an issue on this appeal. The Judge did not deci­de it, and the defen­dants have not filed a respondent’s noti­ce see­king to uphold his decis­i­on on alter­na­ti­ve grounds.

98. The key issue under Artic­le 3(1), as I see it, is whe­ther the crea­ti­on and use of the Patre­on sub­scrip­ti­on faci­li­ty demon­stra­tes “sta­ble arran­ge­ments”. Jay J con­side­red it could not be said to do so, becau­se the sub­scrip­ti­ons could be can­cel­led at any time. I do not think the ans­wer is so clear. The­re does seem to be a set of “arran­ge­ments” here. The CJEU aut­ho­ri­ties pro­vi­de no cri­te­ria for deci­ding whe­ther a given arran­ge­ment is “sta­ble”. Unli­ke the Judge, I do not think the ans­wer is neces­s­a­ri­ly depen­dent on what sub­scri­bers can do in prin­ci­ple, as oppo­sed to what hap­pens in fact. I see force in Mr Cal­lus’ sub­mis­si­on that, in the con­text of this online media publi­ca­ti­on, sub­scrip­ti­on arran­ge­ments of this kind should be view­ed as sta­ble in natu­re. The defen­dants’ evi­dence as to the fun­ding arran­ge­ments for Foren­sic News shows that sub­scrip­ti­ons are a major inco­me stream, con­tri­bu­ting some 85% of total inco­me. I stron­gly suspect that once estab­lished a sub­scrip­ti­on will tend to be main­tai­ned. Cer­tain­ly, the­re is no evi­dence to the contrary.

Zudem kön­ne eine Ver­hal­tens­be­ob­ach­tung i.S.v. Art. 3 Abs. 2 lit. b DSGVO vorliegen:

… The mere fact that the defen­dants crea­ted a coll­ec­tion of per­so­nal data rela­ting to the claimant’s beha­viour in the EU might not be enough. But what they are alle­ged to have done is to assem­ble, ana­ly­se, sort, and recon­fi­gu­re such data, and then publish the result in artic­les inclu­ding (among others) one entit­led “The Wal­ter Soria­no files”. I think it is arguable that tho­se acti­vi­ties fall within the mea­ning of “moni­to­ring”, and within the scope of the EDPB’s noti­ons of “beha­viou­ral ana­ly­sis and pro­fil­ing”. It may be debata­ble whe­ther the noti­ons of tar­ge­ting or ori­en­ta­ti­on towards the EU app­ly in this con­text. Mr Cal­lus sub­mits that the EDPB is wrong about that. But if they do they are argu­ab­ly satis­fied by “sta­ble arran­ge­ments” as alre­a­dy dis­cus­sed, which enable EU citi­zens to sub­scri­be in their local cur­ren­cy to recei­ve Foren­sic News’ jour­na­li­stic output.

AI-generierte Takeaways können falsch sein.