Can I use forum posts related to user to analyze them?

Question

I would like to create an app, which would make analyses based on user behaviors, posts, comments.

I can gather those data from sites, forums because e.g twitter and so are public websites, they are reachable easily. The tricky part is that I could show those analyses, and those analyses would be related to specific users. Just to give you an example: the top commenter user is Jeff Bezos in 2021, the user who has the most discussed under comments is Elon Musk in January 2022... I am not sure if I can use those posts from lets from different websites.

• Twitter, Youtube, Facebook and so...

I feel the legal problem both from:

• the websites I am gathering data,
• and both from the user perspective, but really not sure.

To solve the user GDPR problem, I could ask for confirmation from the users', that the data would be used it could be a different story probably...

And I could even approach Twitter and other sites to request API access to the data and legal confirmation I can use... I actually see a lot of sites that are using big sites and creating statistics based on it, like:

• https://app.sensortower.com
• https://twitchtracker.com/

So somehow those applications solved the legal problem of this.

Answer 1

Such analyses can be legal, but are not necessarily so.

The GDPR expects that all processing of personal data is done for a clear purpose, and is covered by a legal basis. For example, the data subject's consent can be a legal basis. Alternatively, you might have a “legitimate interest” to perform the processing activity. This interest must be weighed against the interests, rights, and freedoms of affected persons. That the data subject made this information public might be a factor for a legitimate interest balancing test, but it really depends on what kinds of analyses you're going to do, what you will do with the results, and if the affected people can reasonably expect this to happen.

If your proposed processing activity is legal, you can conduct it in a GDPR-compliant manner. This will require fulfilling data subject rights. For example, the data subjects might have a right to opt out of your processing. Particularly important is the Art 14 GDPR right to be informed. Since you acquire the personal data from a third party instead of directly from the data subject, you have an obligation to inform them about your processing activities without undue delay, at the latest within one month (there are exceptions though). It is this information obligation that makes many uses of the personal data infeasible.

If you're processing this data for scientific or statistical purposes, you might enjoy some privileges. The GDPR's “purpose limitation principle” does not apply, and you might be excused from Art 14 obligations. But this is dependent on taking suitable safeguards per Art 89 GDPR.

If you see other services that analyze publicly available social media data, that could have a variety of reasons:

• GDPR does not apply to them
• they ignore their GDPR obligations
• they have determined that they have a suitable legal basis for their processing activities

For example, TwitchTracker.com clearly ignores GDPR (no privacy notice), but this may be legal if they aren't subject to GDPR in the first place. If they had tried to comply with GDPR, I think they would have a solid “legitimate interest” argument for allowing to perform this service. But if I were running this service, I would make sure to only aggregate publicly available data from Twitch, so that all streamers I'd be collecting data on have willingly entered the public sphere.

I would be more concerned about publishing statistics on ordinary users, unless they can reasonably expect to be singled out like this.