Report examines how and to what extent CMOs are able to process personal data in the copyright operating environment
The aim of this report dealing with data protection and the copyright infrastructure is to promote the development of the digital services provided by collective management organisations for copyright (CMOs). In order to use the ISNI identifier there was a need to clarify how and to what extent CMOs can supply personal data to the ISNI database and other copyright management organisations considering the impact of the General Data Protection Regulation.
The status of the CMOs was examined from the perspective of the General Data Protection Regulation and the focus was on the right of the CMOs to supply personal data to the ISNI database and other copyright management portals. The roles of the CMOs under the General Data Protection Regulation and the grounds for processing personal data relevant to the topic are also discussed in the report.
In practice, CMOs can process the data on the basis of the author’s consent, a contract between the collective management organisation and the author, or the legitimate interest of the controller or a third party.
Consent is used as a basis for processing, especially when other processing bases do not allow disclosure or other processing of personal data. However, not even consent can be used as a basis for extending the processing to personal data considered manifestly unnecessary. A CMO can choose the processing basis best suited for its own use. Different bases may apply to different information and uses.
CMOs process personal data for the management of copyrights and ensure that the remuneration for the use is paid to the authors. It is therefore important to be able to identify and distinguish each individual actor from each other. One way to distinguish between actors with identical names is to use the ISNI identifier.
Irrespective of whether the processing is based on consent, a contract or a legitimate interest, the collective management organisation acting as the controller must meet the accountability obligation laid down in the General Data Protection Regulation by documenting the bases for processing and the processing measures based on it before the processing begins.
The General Data Protection Regulation does not prevent the disclosure or publication of data on authors and works for purposes compatible with the original purpose. However, the provisions laid down in the General Data Protection Regulation must be taken into account in the processing. Providing transparent information on the processing is a key consideration, as it ensures that data subjects receive a comprehensive and clear picture of the processing of personal data as a whole. In this way, any disclosure of personal data to different parties will not come as a surprise to the data subject.
With regard to the application of the data protection legislation, the General Data Protection Regulation and the national Data Protection Act apply to the processing of the data on authors and works. Disclosing personal data to third parties and publishing it online are also considered processing of personal data. Thus, the right of the CMOs to supply data on authors and works to databases must be assessed from the perspective of what is permitted under the data protection legislation.
The report is part of a more extensive effort to develop Finland’s copyright infrastructure. During its EU Presidency in 2019, Finland highlighted the need to develop the copyright infrastructure i.e. the practices of entering data on works and authors, including identifiers, standards and data sharing formats.
The ISNI project is an essential part of the report. The project has been launched to create a system in which certain CMOs operating in Finland would supply details of actors in the creative sector they keep in their own customer registers to the National Library of Finland, which acts as the national ISNI Registration Agency. The National Library of Finland would then relay the information to the international ISNI database.
The aim of the project is to create ISNI identifiers for the customers of CMOs that would facilitate the unambiguous identification of the authors and help to ensure that the copyright remuneration is paid to the right recipients, especially when the recipients are located in foreign countries.