2

There is a lot of information about what kinds of data the GDPR applies to and what responsibilities a person collecting or processing such data has (e.g. on Wikipedia), but I have found little information about whether these rules apply also to publicly available data (e.g. from the internet). Does the GDPR apply to such data?

Examples:

  • I have a printed phone directory in my office, which lists names and phone numbers of people. This seems to be "information that relates to an identified or identifiable individual", so reading the wikipedia page literally, this should be covered by the GDPR. Since this is my my office, it does not seem to me that "Recital 18" should make this exempt from the GDPR. But clearly, locking the phone book away or informing everybody listed in the phone book that I hold their phone number makes no sense. Is my copy of the phone book covered by the GDPR, or not?

  • If I download 10,000 tweets using the Twitter API and do some statistical analysis on these tweets (e.g. to determine the most common words), is my collection of downloaded tweets covered by the GDPR? Again, notifying everybody that I downloaded their tweets seems to make no sense. Are there any obligations I have in storing and using this data?

  • Does the presence of a name in a phone book imply that person's consent with being listed in the phone book? I suppose it does, because otherwise I feel like the phone book's author might be in legal trouble. – John Dvorak Aug 30 '19 at 13:44
  • @JohnDvorak I guess the situation of the person producing the phone book may be closer to what the GDPR is made to cover, and restrictions there make sense to me. But my question is about the paper copy in my office. Maybe I'm off the hook there, because I'm not "collecting" the data? – jochen Aug 30 '19 at 13:48
  • In Germany, the telephone book maker needs consent from the number owner how and with what information they wish to be listed - without they can't be listed at all – Trish Aug 30 '19 at 14:32
  • @Trish the phone book maker may be ok, but my question is about my copy of the phone book, and I don't have an agreement with the people listed. – jochen Aug 30 '19 at 15:30
  • @jochen by owning a telephone book you do agree to the ToS the Phonebook has, For example the Yellow Pages contain a paragraph saying "you are not allowed to use these numbers to process them comercially" – Trish Aug 30 '19 at 15:51
2

GDPR applies to all personal data

What your obligation are depend on if you are a controller, processor or neither.

For the phone book you are neither and have no obligations.

For the tweets you are likely a controller and a processor.

  • I am still not sure what the obligations may be. For example the requirement that "the data can be accessed, altered, disclosed or deleted only by those you have authorised to do so." Since the data is public, I cannot possibly make sure that it can only be accessed with my authorisation. Other rules similarly seem difficult to apply. So what are my obligations for the tweets? – jochen Aug 31 '19 at 21:15
  • 2
    @jochen you are only a controller for the data you collected - your copy of the tweets and the processing done to them. – Dale M Aug 31 '19 at 21:18
0

There is no blanket exemption for publicly available data and one conclusion could be that the processing you have in mind is simply illegal. If your only basis for processing is consent then collecting the data and only then begging for consent after the fact seems questionable in itself, it's neither required nor sufficient to make sure what you want to do is legal. Twitter is a large well-known company that presumably secured some form of consent for some purposes but what if you were downloading data from some unknown third-party? Or from a data dump on the dark web?

So in that case, either the Twitter data comes with appropriate guarantees regarding consent to the transfer and kind of processing you have in mind or you have some other basis for processing (and you can use the data as is). Or they don't and you shouldn't touch these data. The fact someone put them on a website or provides an API doesn't exempt you from your obligations as a data controller including evaluating the legality of any data processing you are in charge of nor does it mean there is an easy way to exploit them while staying within the bounds of the GDPR.

While notifying data subjects is not necessarily mandatory, data controllers and/or processors do have a number of other obligations: offering a way for data subjects to exercise their right to access, modification, erasure and processing restriction, ensuring data security, creating a data retention policy, notifying data breaches, etc.

  • About the twitter data: the data is provided by Twitter themselves, see developer.twitter.com/en/docs/api-reference-index . So no "unknown third parties" or "dark web" involved. – jochen yesterday
  • @jochen Yes, that's exactly what I wrote. But if being publicly available and/or having no prior relationships with the data subjects would exempt you from GDPR requirements, this would also apply to all those cases. It obviously does not. You're always responsible for evaluating what you do with the data, no matter where it comes from. – Relaxed 20 hours ago

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.