There is a lot of information about what kinds of data the GDPR applies to and what responsibilities a person collecting or processing such data has (e.g. on Wikipedia), but I have found little information about whether these rules apply also to publicly available data (e.g. from the internet). Does the GDPR apply to such data?
I have a printed phone directory in my office, which lists names and phone numbers of people. This seems to be "information that relates to an identified or identifiable individual", so reading the wikipedia page literally, this should be covered by the GDPR. Since this is my my office, it does not seem to me that "Recital 18" should make this exempt from the GDPR. But clearly, locking the phone book away or informing everybody listed in the phone book that I hold their phone number makes no sense. Is my copy of the phone book covered by the GDPR, or not?
If I download 10,000 tweets using the Twitter API and do some statistical analysis on these tweets (e.g. to determine the most common words), is my collection of downloaded tweets covered by the GDPR? Again, notifying everybody that I downloaded their tweets seems to make no sense. Are there any obligations I have in storing and using this data?