data-protection gdpr
Does the GDPR allow me to access data from public sources, store it and anaylize it?
<p>I've been researching about the GDPR on the internet to find an answer to my question, but I have not found a concrete answer.</p>

<p>Does the GDPR allow me (my software/server) to derive data, store it and use it for any purpose?</p>

<p>For example: perform an analysis of a person via their ex: (twitter feed) and store the analysis. All of this without needing to inform the person of the analysis or them having the right to transfer/remove/get a copy of the analysis from me(my software/server)? </p>

<p>Could a loophole be to perform the analysis and store only the "connections"? Almost like giving a person a mathematical function without any plotted data, You give the end user a pre-made "template" (the analysis report) that they fill out by fetching the feed themselves?</p>

<p>Data can only be processed if there is at least one <a href="https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/" rel="nofollow noreferrer">lawful basis</a> to do so. The lawful bases for processing data are:</p>

<ul>
<li>the data subject has given consent to the processing of his or her personal data for one or more specific purposes.</li>
<li>processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.</li>
<li>processing is necessary for compliance with a legal obligation to which the controller is subject.</li>
<li>processing is necessary in order to protect the vital interests of the data subject or of another natural person.</li>
<li>processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.</li>
<li>processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.</li>
</ul>

<p>So unless you have some very compelling reason to need to process that person's data without their consent, you can't legally do it. Therefore it is hard to see how you could produce this "template", and even if you somehow did the person receiving it might not have a lawful basis for fetching (processing) that data anyway.</p>

<p>Possibly if you were a professor writing a scientific paper on online behavior you might find some relief in <a href="https://gdpr-info.eu/art-89-gdpr/" rel="nofollow noreferrer">Article 89</a>.</p>

<p>But that would seem to require removing personally identifiable information from the data so that it is no longer easily traceable to an individual. </p>

<blockquote>
  <p>Processing for archiving purposes in the public interest, scientific
  or historical research purposes or statistical purposes, shall be
  subject to appropriate safeguards, in accordance with this Regulation,
  for the rights and freedoms of the data subject. 2Those safeguards
  shall ensure that technical and organisational measures are in place
  in particular in order to ensure respect for the principle of data
  minimisation. 3Those measures may include pseudonymisation provided
  that those purposes can be fulfilled in that manner. 4Where those
  purposes can be fulfilled by further processing which does not permit
  or no longer permits the identification of data subjects, those
  purposes shall be fulfilled in that manner.</p>
</blockquote>
