Does the GDPR allow me to access data from public sources, store it and anaylize it?

Question

I've been researching about the GDPR on the internet to find an answer to my question, but I have not found a concrete answer.

Does the GDPR allow me (my software/server) to derive data, store it and use it for any purpose?

For example: perform an analysis of a person via their ex: (twitter feed) and store the analysis. All of this without needing to inform the person of the analysis or them having the right to transfer/remove/get a copy of the analysis from me(my software/server)?

Could a loophole be to perform the analysis and store only the "connections"? Almost like giving a person a mathematical function without any plotted data, You give the end user a pre-made "template" (the analysis report) that they fill out by fetching the feed themselves?

Answer 1

Data can only be processed if there is at least one lawful basis to do so. The lawful bases for processing data are:

• the data subject has given consent to the processing of his or her personal data for one or more specific purposes.
• processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
• processing is necessary for compliance with a legal obligation to which the controller is subject.
• processing is necessary in order to protect the vital interests of the data subject or of another natural person.
• processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
• processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

So unless you have some very compelling reason to need to process that person's data without their consent, you can't legally do it. Therefore it is hard to see how you could produce this "template", and even if you somehow did the person receiving it might not have a lawful basis for fetching (processing) that data anyway.

Answer 2

Possibly if you were a professor writing a scientific paper on online behavior you might find some relief in Article 89.

But that would seem to require removing personally identifiable information from the data so that it is no longer easily traceable to an individual.

Processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, shall be subject to appropriate safeguards, in accordance with this Regulation, for the rights and freedoms of the data subject. 2Those safeguards shall ensure that technical and organisational measures are in place in particular in order to ensure respect for the principle of data minimisation. 3Those measures may include pseudonymisation provided that those purposes can be fulfilled in that manner. 4Where those purposes can be fulfilled by further processing which does not permit or no longer permits the identification of data subjects, those purposes shall be fulfilled in that manner.

Answer 3

"for any purpose"

Nope.

If you could demonstrate that the products your customers buy from you would be value-less without you processing that data, then Maybe. And you'd need to clearly state somewhere in the terms something like 'we may look online for traces of you and your data, and process that data to determine behaviour patterns. we may use those determined patterns to customise your customer experience.'

Assume your business is made entirely of glass, and that your customers are the real authority on what you are allowed to do to/about them. And just because Peter is paying you to spy on Paul, doesn't mean you can ignore Paul's rights/preferences ;)