The GDPR protects public personal data pretty much the same as non-public data, meaning: you can process the data only if you have a clear purpose and legal basis. It is the purpose that determines which GDPR Art 6 legal basis you can rely on, such as consent (opt-in) or legitimate interest (opt-out).
Summary:
- you may or may not be able to contact them, depending on the context in which the contact information was published and on the purpose for which you are contacting them
- consent is tricky, but to some degree it can be implied
- relying on legitimate interest would require a balancing test
- yes you have to inform the data subject
- yes you have to give an opportunity to object or to withdraw consent
- You must even be prepared to get an objection at any time and then remove the data.
Where you didn't obtain the contact details directly from the data subject, it will be difficult to argue that you obtained “consent”. Consent doesn't have to be a statement such as “I consent”, but can also be given through a “clear affirmative action”. What is important that the data subject's wishes are unambiguous.
So for example, if there's a social media post about seeking jobs, and the data subject publicly comments with their email address, then contacting the data subject with a job offer is likely fine. Posting contact details in that context is a fairly unambiguous action indicating the data subject's wishes. But consent is purpose-limited. Using this email address with an offer to paint their house would not fly using consent as the legal basis – but you might have a legitimate interest?
Legitimate interest requires that you express this interest and then balance it against the data subject's rights and freedoms. What is more important: that you can send this message or that the data subject is undisturbed? Would the data subject expect this use of their data? This is a judgement call on your part. Adding security measures beyond those required by law can shift the balancing test in your favour, but this is difficult to do. Use of legitimate interest gives rise to the Art 21 GDPR right to object (opt-out).
When sending unsolicited electronic communications, it's important to consider the ePrivacy directive in addition to the GPDR. The ePD Art 13 forbids automated direct marketing such as mass emails unless the recipient has consented. However, I read that article as allowing messages that are sent by humans, or messages that are not “direct marketing”. But in any case you should make it easy for the recipient to withdraw consent / to object to further processing.
Regardless of whether the data has been obtained from public or non-public sources, your processing of this data will likely have to be GDPR-compliant. When you use third party services, they should act as your data processor which requires a contract per GDPR Art 28. If you use an email provider or CRM for business purposes, they should be made your data processor. When you export data to a non-EU country, you need to protect this international transfer per GDPR Chapter 5, e.g. through Standard Contractual Clauses with the data importer.
In addition to general compliance obligations, you have to consider GDPR Art 14. This article describes information that you must give the data subject about your processing when you didn't obtain the data directly from the data subject. Essentially, this means that you must give them a privacy policy. Per Art 14(2)(f), you must indicate the source of their data, e.g. the social media network where you found their contact details. You must provide this information when you disclose this data to someone else, when you first communicate with the data subject, or within a reasonable period after obtaining the data, at the latest within one month.
