GDPR on 3 attributes of scraped data
<p>I have scraped horse rating data with the intent of hosting an API users can subscribe to and query the dataset in various different forms e.g. Excel, JSON etc... with added analytics applied as well.</p>
<p>Parts of the data are Jockey Name, Trainer Name and Owner Name. (This one could be a person or a business.)</p>
<p>My question is:  Given this data is in the public domain, would I still be liable as a data controller, now that I have scraped the data and intend to sell it on?</p>

<p>It depends on your legal basis for processing this data.</p>
<p>You've correctly pointed out that your scraped data includes personal data, i.e. information about identifiable natural persons (the data subjects). Since you decided why and how this data is processed, you are the data controller and are responsible for compliance. You are not a “data processor” in the GDPR sense, as that means someone who processes personal data on behalf of another data controller.</p>
<p>The GDPR allows processing of personal data when there is a clear purpose that is covered by a legal basis, such as “consent” or a “legitimate interest”. A legitimate interest always requires a balancing test between the interest and the data subject's rights and interests. Usually, a legitimate interest can only prevail if the data subject can reasonably expect this processing activity to occur. Higher-level athletes can probably reasonably expect that statistics about them are being collated and shared, whereas this would likely be inappropriate at a hobbyist or youth level.</p>
<p>The GDPR doesn't quite have a concept of “public domain”. Even if you use publicly available data, <em>your use</em> must be lawful. There are only very few circumstances where the GDPR considers public availability to be relevant. The ones I know:</p>
<ul>
<li>As part of your Art 14 transparency obligations you have to tell the data subjects “from which source the personal data originate, and if applicable, whether it came from publicly accessible sources” (Art 14(2)(f)).</li>
<li>Per Art 9, processing of “special categories” of data such as health data is forbidden, unless an exception applies. One exception is the data subject's explicit consent, another if the data was “manifestly made public by the data subject” themselves (Art 9(2)(e)).</li>
<li>If <em>you</em> published personal data for example on a website, then the Art 17 right to erasure can require to notify other data controllers that they should delete the data as well. For example, a website should notify search engines that the page with deleted information should be re-crawled.</li>
</ul>

gdpr