In short. Public availability leaves GDPR obligations in place, including an applicable lawful basis and transparency duties subject to specific exceptions.
Definition: Public availability does not exempt personal data, information relating to an identified or identifiable individual, from the General Data Protection Regulation (GDPR). The European Data Protection Board's Opinion 28/2024 applies GDPR Articles 5 and 6 to AI model processing, including collection from publicly accessible sources.
Key facts
- The EDPB's Opinion 28/2024, adopted on 17 December 2024, requires a documented assessment of legitimate interests, necessity and the balance with individuals' rights when relying on legitimate interests for AI model processing.
- GDPR Articles 5 and 6 require compliance with processing principles and an applicable lawful basis, including when the source is publicly accessible.
- CNIL's guidance of 5 January 2026 includes web scraping within indirect collection and requires a case-specific, documented assessment before relying on disproportionate effort to omit individual information.
Which obligations remain when data is public?
Under GDPR Article 4, processing includes collection, storage and use. A controller is the person or organisation that determines the purposes and means of processing. These definitions cover operations on personal data obtained from websites.
Article 5 requires lawful, fair and transparent processing, specified purposes, data minimisation, accuracy, limited retention and appropriate security. Data minimisation means limiting personal data to what is necessary for the processing purpose. Article 5(2) makes the controller responsible for demonstrating compliance.
Article 6(1) requires an applicable lawful basis. Its grounds include consent and, subject to its conditions, legitimate interests. A public source supplies no additional lawful basis outside that article. A website's accessibility therefore leaves the collector responsible for identifying a basis for its own processing purpose.
How does public availability affect legitimate interests?
The legitimate interests basis under Article 6(1)(f) permits necessary processing for a controller's or another party's legitimate interests, subject to balancing against individuals' interests and fundamental rights. The EDPB opinion requires assessment and documentation of all three conditions. Necessity includes considering less intrusive ways to pursue the interest.
Paragraphs 93 and 94 address reasonable expectations during model development. Relevant factors include the source website's privacy settings, the relationship with the collector, possible further uses of the model and whether people know their data is online. Whether the person made the data public also matters. Public availability is one element of this assessment.
What information must a collector provide?
GDPR Article 14 governs information duties when personal data comes from another source. Required information includes the controller's identity, purposes, legal basis, data categories, retention arrangements and applicable rights. Article 14(2)(f) expressly requires information about the source and, where applicable, its public accessibility.
Article 14(3) sets a reasonable period of at most one month after obtaining the data. If communication with the person or disclosure to another recipient happens earlier, information is due by that first communication or disclosure.
Article 14(5)(b) provides an exception where informing individuals proves impossible or involves disproportionate effort, subject to its conditions. It still requires protective measures, including making the information publicly available. CNIL's information guidance requires documented balancing of the burden of individual information against the effects on people. Its example says a controller reusing customer data should use customers' email addresses, if still held, to inform them individually.
Related terms
- GDPR lawful basis for web data
- GDPR transparency for web collection
- GDPR data minimisation
- GDPR right to object
FAQ
Must you obtain consent for every public webpage containing personal data?
GDPR Article 6(1) provides several lawful bases. You must identify one that applies to your processing and satisfy its conditions; consent is one option.
Does a public post remove restrictions on health data?
Health data falls within Article 9's special categories, whose processing requires an applicable exception alongside a lawful basis. Article 9(2)(e) concerns data manifestly made public by the person; the EDPB opinion explains that public accessibility alone fails to establish that condition.
Can you object after your data appears online?
Article 21(1) permits objections based on your particular situation to processing relying on legitimate interests. The controller must stop unless it demonstrates overriding compelling legitimate grounds or processing serves the establishment, exercise or defence of legal claims.
Sources
- European Data Protection Board, "Opinion 28/2024 on certain data protection aspects related to the processing of personal data in the context of AI models", 17 December 2024
- European Parliament and Council, "Regulation (EU) 2016/679", 27 April 2016
- CNIL, "Informing data subjects", 5 January 2026
Check how a page reads to answer engines. Open the GEO score analyzer