Das Court of Appeal hat einem in UK ansässigen israelischen Geschäftsmann erlaubt, eine datenschutzrechtliche Klage gegen den US-amerikanischen Anbieter einer News-Website einzureichen, dies im Zusammenhang mit einer kritischen Berichterstattung der Website über den Kläger (Soriano vs. Forensic News LLC).
Strittig war die Frage, ob der Anbieter in den Anwendungsbereich der DSGVO fiel. Das Gericht hat diese Frage bejaht, oder genauer: Es hielt diesen Schluss für vertretbar (“arguable”), die im Rahmen des Verfahrens erforderliche Schwelle.
Zum einen kann es sein, dass eine Niederlassung i.S.v. Art. 3 Abs. 1 lit. a DSGVO bestand, und zwar – überraschenderweise – aufgrund der Tatsache, dass sich die News-Website über Patreon finanziert und das Angebot entsprechender Abonnente eine Niederlassung darstellen könnte (es wäre wohl näher gelegen, dies unter Art. 3 Abs. 1 lit. a DSGVO zu prüfen, also der Angebotsausrichtung):
96. It is very likely that the CJEU authorities on the meaning of “establishment” in Article 4 of the Directive would guide a decision on the meaning of the same word in Article 3(1) of the GDPR. I consider it arguable that the defendants had an “establishment” in the EU within that meaning at the material times. I share the doubts expressed by Arnold LJ when granting permission to appeal on this point. However, as Mr Callus has emphasised, the authorities set a low bar, and all the claimant has to do at this stage is to persuade the court that it is not fanciful to think that his case crosses that low bar.
97. Recital (23) suggests that a critical consideration here is whether the data controller or processor “envisages offering services to data subjects in one or more Member States in the Union”. On the evidence, the defendants did more than merely making their journalism accessible over the world wide web. They intended to make their output available in the UK and EU, and succeeded in attracting a more than minimal readership. In due course they expressly solicited subscriptions from within the UK and EU, via the Patreon platform. They succeeded in securing three subscriptions in sterling and three in Euros. This may be “minimal” activity but nothing more is required, according to the authorities. The offer and acceptance of subscriptions in these local currencies is arguably a “real and effective” activity that is “oriented” towards the UK and EU. Jay J said that the journalistic endeavour was not so oriented but that, as it seems to me, goes more to the separate question of whether the journalistic processing complained of arguably took place “in the context of” the activities of an “establishment”. That is not an issue on this appeal. The Judge did not decide it, and the defendants have not filed a respondent’s notice seeking to uphold his decision on alternative grounds.
98. The key issue under Article 3(1), as I see it, is whether the creation and use of the Patreon subscription facility demonstrates “stable arrangements”. Jay J considered it could not be said to do so, because the subscriptions could be cancelled at any time. I do not think the answer is so clear. There does seem to be a set of “arrangements” here. The CJEU authorities provide no criteria for deciding whether a given arrangement is “stable”. Unlike the Judge, I do not think the answer is necessarily dependent on what subscribers can do in principle, as opposed to what happens in fact. I see force in Mr Callus’ submission that, in the context of this online media publication, subscription arrangements of this kind should be viewed as stable in nature. The defendants’ evidence as to the funding arrangements for Forensic News shows that subscriptions are a major income stream, contributing some 85% of total income. I strongly suspect that once established a subscription will tend to be maintained. Certainly, there is no evidence to the contrary.
Zudem könne eine Verhaltensbeobachtung i.S.v. Art. 3 Abs. 2 lit. b DSGVO vorliegen:
… The mere fact that the defendants created a collection of personal data relating to the claimant’s behaviour in the EU might not be enough. But what they are alleged to have done is to assemble, analyse, sort, and reconfigure such data, and then publish the result in articles including (among others) one entitled “The Walter Soriano files”. I think it is arguable that those activities fall within the meaning of “monitoring”, and within the scope of the EDPB’s notions of “behavioural analysis and profiling”. It may be debatable whether the notions of targeting or orientation towards the EU apply in this context. Mr Callus submits that the EDPB is wrong about that. But if they do they are arguably satisfied by “stable arrangements” as already discussed, which enable EU citizens to subscribe in their local currency to receive Forensic News’ journalistic output.