Wikimedia Foundation Inc – Dismissed (Austria, 2023)

The data subject is an Austrian artist who is known to a wider public in Austria through his work as a filmmaker, screenwriter and cameraman. The controller, Wikimedia Foundation Inc, is the operator of Wikipedia.org. The data subject requested the controller to erase all his data under Article 17 GDPR, because the data was inaccurate and not up to date. The registered films were not up to date and there were also errors with certain films, in which he was either not correctly listed or the films had incorrect titles. The controller refused the erasure request based on two reasons. Firstly, the controller claimed that it did not fall under the territorial scope of the GDPR (Article 3 GDPR) as it was based exclusively in the USA and under US law, and thus the GDPR is not applicable. It also did not provide any goods or services to persons such as the data subject. Secondly, the data processing was lawful due to the legitimate interest of the public as the data subject is a public figure and the processing was carried out for journalistic purposes. Even if the GDPR was applicable, the controller claimed that the data subject would not be entitled to erasure because the media privilege would apply. The data subject filed a complaint with the Austrian DPA (Datenschutzbehörde, DSB), claiming that data processed by the controller was not factually accurate or up to date. The principle of accuracy under Article 5(1)(d) GDPR obliges the controller to ensure that the data is both factually correct and, if necessary, up to date. Regarding the applicability of the GDPR, the DPA found that, although the controller was based in the USA, it had a total of 38 national branch associations with at least one of them located in Austria. There was also an automatic redirection (after entering a search term) from "http://wikipedia.at" to "https://de.wikipedia.org", which clearly showed the close links between the controller’s (branch) associations and the controller itself and the aim of facilitating access for Austrian users. Moreover, the article of the data subject was only available in English and German. Thus, the information service about the data subject is obviously aimed at the German-speaking area and not only at the US. The controller obviously intended to attract Austrian users to its information service, thus fulfilling the requirement under Article 3(2)(a) GDPR. The DPA therefore held that the material and territorial scope of application were met and thus, the GDPR is applicable. The DPA also held that the controller must at least be qualified as a joint controller with its users under Article 4(7) GDPR as the controller was responsible for raising funds, controlling the servers, developing the software and public relations work to support all its projects and its website and intervene directly in cases where swift action is required. Regarding the controller’s claim they have media privilege, Article 85 GDPR allows for Member States to provide for exemptions for processing carried out for journalistic purposes to the purpose of academic artistic or literary expression. According to the DPA’s established national practice, two conditions must be met cumulatively for the media privilege to apply: # Personal data must be processed by the media owner, publisher, media employees and employees of a media organisation or media service within the meaning of the Austrian Media Act; # this processing must be for journalistic purposes of the media organisation or media service. Since the person who is ultimately responsible for the content and editing of the content distributed via the network is understood to be the media owner, the DPA found that in this case the controller was not involved in the content design and cannot be qualified as a media owner. Therefore, the first condition was not met and media privilege did not apply and the DPA was responsible for handling the complaint. Regarding the inaccuracy of data, the DPA found that the film titles were correct and thus no inaccuracy could be established. On the not up to date data, the DPA explained that the controller's legal obligation to complete the data only exists in those cases in which the added information is actually relevant to the processing of data in order to ensure the objective accuracy of the data. The purpose of the processing by the controller in this case is to provide general information about the data subject for users of the website. The DPA found that it does not mean that all works in which the data subject has participated needs to be listed exhaustively. Merely an overview of the filmography is sufficient to fulfill the processing purpose. Therefore, the DPA held that the processing purpose within the meaning of Article 5(1)(d) GDPR had not been violated. Regarding the data subject’s right to erasure, the DPA explained that there is an exception under Article 17(3)(a) GDPR if the processing is necessary for exercising the right to freedom of expression and information. This is not absolute and must be weighed against the fundamental rights in the Charter. Because the data subject was a public figure who is known to a broad public and the data could not be qualified as false, untrue or inaccurate, the intensity of the interference was classified by the DPA as low. Therefore, the DPA held that the legitimate interests of the general public pursuant to Article 11 of the Charter of Fundamental Rights in access to information outweigh the flawed legitimate interests of the data subject. Thus, the exception of Article 17(3)(a) GDPR applies and therefore the DPA found that the controller correctly did not comply with the data subject’s request.