There is a lot of information about what kinds of data the GDPR applies to and what responsibilities a person collecting or processing such data has (e.g. on Wikipedia), but I have found little information about whether these rules apply also to publicly available data (e.g. from the internet). Does the GDPR apply to such data?


  • I have a printed phone directory in my office, which lists names and phone numbers of people. This seems to be "information that relates to an identified or identifiable individual", so reading the wikipedia page literally, this should be covered by the GDPR. Since this is my my office, it does not seem to me that "Recital 18" should make this exempt from the GDPR. But clearly, locking the phone book away or informing everybody listed in the phone book that I hold their phone number makes no sense. Is my copy of the phone book covered by the GDPR, or not?

  • If I download 10,000 tweets using the Twitter API and do some statistical analysis on these tweets (e.g. to determine the most common words), is my collection of downloaded tweets covered by the GDPR? Again, notifying everybody that I downloaded their tweets seems to make no sense. Are there any obligations I have in storing and using this data?

  • Does the presence of a name in a phone book imply that person's consent with being listed in the phone book? I suppose it does, because otherwise I feel like the phone book's author might be in legal trouble. – John Dvorak Aug 30 at 13:44
  • @JohnDvorak I guess the situation of the person producing the phone book may be closer to what the GDPR is made to cover, and restrictions there make sense to me. But my question is about the paper copy in my office. Maybe I'm off the hook there, because I'm not "collecting" the data? – jochen Aug 30 at 13:48
  • In Germany, the telephone book maker needs consent from the number owner how and with what information they wish to be listed - without they can't be listed at all – Trish Aug 30 at 14:32
  • @Trish the phone book maker may be ok, but my question is about my copy of the phone book, and I don't have an agreement with the people listed. – jochen Aug 30 at 15:30
  • @jochen by owning a telephone book you do agree to the ToS the Phonebook has, For example the Yellow Pages contain a paragraph saying "you are not allowed to use these numbers to process them comercially" – Trish Aug 30 at 15:51

GDPR applies to all personal data

What your obligation are depend on if you are a controller, processor or neither.

For the phone book you are neither and have no obligations.

For the tweets you are likely a controller and a processor.

  • I am still not sure what the obligations may be. For example the requirement that "the data can be accessed, altered, disclosed or deleted only by those you have authorised to do so." Since the data is public, I cannot possibly make sure that it can only be accessed with my authorisation. Other rules similarly seem difficult to apply. So what are my obligations for the tweets? – jochen Aug 31 at 21:15
  • @jochen you are only a controller for the data you collected - your copy of the tweets and the processing done to them. – Dale M Aug 31 at 21:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.