Does GDPR apply when PII is already publicly available?
<p>Pretend there is a website, it might be free to access, or be a paid per search service, where the users get access to summarised information on the people that they search for.</p>
<p>All of the information this website displays has been taken from public sources, such as news papers, personal profiles on company websites, LinkedIn, Facebook, other websites etc... Nothing has been copied from these sources, aside from the person's full name and position (such as secretary).</p>
<p>The people have never consented to having their data published onto this website, it was mined manually by employees.</p>
<p>Would the people be allowed to request their data be removed? I am interested in how GDPR or the Data Protection Act would apply when this information is already publicly available.</p>

<p>The site would combine the data in novel ways, which is <em>processing</em> the data. Processing personal data which is publicly available is still processing personal data.</p>
<p>You would have to take GDPR into account. That does not mean the processing is forbidden, but you need a legal basis for doing it. In many ways, having the informed consent is the easiest legal basis, but there are others. The data subject would have the right to demand information about the data you hold, and to demand the correction of wrong data. There is not <em>necessarily</em> a right to demand deletion, but if consent is withdrawn and you have <em>no other</em> basis for data processing, you have to delete.</p>
<p>Note also that the consent basis would mean you have to <em>actively</em> contact the people whose consent you seek before the processing starts, and document how you do it. That makes pay-per-request models difficult.</p>
<p>But consider that the news media can process <em>some</em> data about <em>some</em> people without the consent of the subjects of their activities. They just need to balance privacy and other legitimate interests all the time.</p>

united-kingdom england-and-wales gdpr european-union data-protection-act