does the GDPR apply to publicly available data?

Question

There is a lot of information about what kinds of data the GDPR applies to and what responsibilities a person collecting or processing such data has (e.g. on Wikipedia), but I have found little information about whether these rules apply also to publicly available data (e.g. from the internet). Does the GDPR apply to such data?

Examples:

• I have a printed phone directory in my office, which lists names and phone numbers of people. This seems to be "information that relates to an identified or identifiable individual", so reading the wikipedia page literally, this should be covered by the GDPR. Since this is my my office, it does not seem to me that "Recital 18" should make this exempt from the GDPR. But clearly, locking the phone book away or informing everybody listed in the phone book that I hold their phone number makes no sense. Is my copy of the phone book covered by the GDPR, or not?

• If I download 10,000 tweets using the Twitter API and do some statistical analysis on these tweets (e.g. to determine the most common words), is my collection of downloaded tweets covered by the GDPR? Again, notifying everybody that I downloaded their tweets seems to make no sense. Are there any obligations I have in storing and using this data?

Answer 1

GDPR applies to all personal data

What your obligation are depend on if you are a controller, processor or neither.

For the phone book you are neither and have no obligations.

For the tweets you are likely a controller and a processor.

Answer 2

There is no blanket exemption for publicly available data and one conclusion could be that the processing you have in mind is simply illegal. If your only basis for processing is consent then collecting the data and only then begging for consent after the fact seems questionable in itself, it's neither required nor sufficient to make sure what you want to do is legal. Twitter is a large well-known company that presumably secured some form of consent for some purposes but what if you were downloading data from some unknown third-party? Or from a data dump on the dark web?

So in that case, either the Twitter data comes with appropriate guarantees regarding consent to the transfer and kind of processing you have in mind or you have some other basis for processing (and you can use the data as is). Or they don't and you shouldn't touch these data. The fact someone put them on a website or provides an API doesn't exempt you from your obligations as a data controller including evaluating the legality of any data processing you are in charge of nor does it mean there is an easy way to exploit them while staying within the bounds of the GDPR.

While notifying data subjects is not necessarily mandatory, data controllers and/or processors do have a number of other obligations: offering a way for data subjects to exercise their right to access, modification, erasure and processing restriction, ensuring data security, creating a data retention policy, notifying data breaches, etc.