Are public posts on social media personal data, and on what legal basis may a public authority collect them?

Direct answer · GDPR

Public posts on social media

Yes, if the post relates to an identified or identifiable person. Personal data are any information relating to such a person (Article 4(1)); the definition makes no exception for information that is public. Whoever collects such posts needs a legal basis under Article 6(1), and the fact that a post is public is not on that list. A public authority cannot rely on legitimate interest when performing its tasks (Article 6(1), second subparagraph). It can rely on a legal obligation or on a task carried out in the public interest or in the exercise of official authority (Article 6(1)(c) and (e)). That basis must be laid down by Union or Member State law, the processing must be necessary for that task, and the law must meet an objective of public interest and be proportionate (Article 6(3)). Where the posts reveal special categories of data, such as political opinions, religion or health, the prohibition of Article 9(1) applies. The Court of Justice in Meta Platforms v Bundeskartellamt interprets the exception for data manifestly made public by the data subject (Article 9(2)(e)) strictly: it applies only to data the data subject made public themselves, not to data about others, and only where they explicitly chose to make the data accessible to an unlimited number of persons. In Schrems v Meta the Court held that someone who speaks publicly in a discussion about their sexual orientation does not thereby allow the processing of other data about it. The GDPR does not apply to the prevention, investigation, detection or prosecution of criminal offences by the competent authorities (Article 2(2)(d)).