8

Pretend there is a website, it might be free to access, or be a paid per search service, where the users get access to summarised information on the people that they search for.

All of the information this website displays has been taken from public sources, such as news papers, personal profiles on company websites, LinkedIn, Facebook, other websites etc... Nothing has been copied from these sources, aside from the person's full name and position (such as secretary).

The people have never consented to having their data published onto this website, it was mined manually by employees.

Would the people be allowed to request their data be removed? I am interested in how GDPR or the Data Protection Act would apply when this information is already publicly available.

Improve this question
3
  • 23
    Data being public and data being in the public domain is not at all the same thing.
    – Eike Pierstorff
    Commented Jul 12, 2023 at 17:10
  • 1
    In those countries the GDPR was modelled after, even decades ago in the day of publicly available printed telephone books, "scraping" that data and using it was subject to deletion requests from the subject(s).
    – nvoigt
    Commented Jul 13, 2023 at 7:08
  • @EikePierstorff since the question doesn't mention copyright, I assume OP means the former and have edited the title accordingly
    – MJD
    Commented Jul 13, 2023 at 19:30

1 Answer 1

Reset to default
22

The site would combine the data in novel ways, which is processing the data. Processing personal data which is publicly available is still processing personal data.

You would have to take GDPR into account. That does not mean the processing is forbidden, but you need a legal basis for doing it. In many ways, having the informed consent is the easiest legal basis, but there are others. The data subject would have the right to demand information about the data you hold, and to demand the correction of wrong data. There is not necessarily a right to demand deletion, but if consent is withdrawn and you have no other basis for data processing, you have to delete.

Note also that the consent basis would mean you have to actively contact the people whose consent you seek before the processing starts, and document how you do it. That makes pay-per-request models difficult.

But consider that the news media can process some data about some people without the consent of the subjects of their activities. They just need to balance privacy and other legitimate interests all the time.

Improve this answer
9
  • 1
    The typical legal basis in this context would be a "legitimate interest", not consent. But LI requires performing a balancing test that takes into account the data subjects' reasonable expectations. Processing for journalistic purposes may benefit from an Art 85 GDPR exception, but that depends entirely on national laws.
    – amon
    Commented Jul 14, 2023 at 4:42
  • 2
    @amon, the site could probably generate and post bios of sports stars or cabinet officials. But not bios of average guys.
    – o.m.
    Commented Jul 14, 2023 at 4:57
  • 2
    @user5623335, it would make a difference, but how much of a difference depends on countless details, including the country you are operating in/from. Even convicted criminals have some right to privacy.
    – o.m.
    Commented Jul 14, 2023 at 16:30
  • 3
    @user5623335 Careful when processing data about trials: Art 10 GDPR forbids processing that relates to criminal convictions, except as explicitly authorized by some other law.
    – amon
    Commented Jul 15, 2023 at 11:02
  • 2
    @user5623335, not that simple. You will need to prepare formal documents, describing exactly which data you want to retain and on what legal basis, and why you think it applies. With consent, that is relatively easy. "They gave informed consent, so I do it." Still necessary to check that it is appropriate data use, or that the TOM are enough. Without consent, it is harder. You would have to explain why your interests in exploiting their data outweighs their interest in privacy. If this is an idea for a startup company, your business plan needs to include hiring specialist lawyers.
    – o.m.
    Commented Jul 16, 2023 at 4:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .