GDPR , Safe Harbor, and Public Data

Special Edition Safe Harbor, GDPR, Public Data

GDPR Implications of Processing Publicly Available Information in the Context of the EU-US Safe Harbor Framework Limitation of Liability: The content of this white paper is presented for educational and informational purposes only. The authors and publishers disclaim any responsibility for any legal consequences arising from the use of or reliance on the information provided herein. This document does not constitute legal advice, and no attorney-client relationship is formed by accessing or using this material.

GDPR Implications of Processing Publicly Available Information in the Context of the EU-US Safe Harbor Framework I. Introduction The term "Safe Harbor Act" can refer to various pieces of legislation. Within the United States, for instance, the Safe Harbor Act in New York State was initially drafted with the primary goals of ceasing the criminalization of child victims of domestic sex trafficking and establishing essential services and legal authority to support these victims 1. This legislation aimed to recognize that children subjected to commercial sexual exploitation are victims of crimes, not perpetrators, and to provide them with necessary care and protection 1. The passage of such laws across numerous states signifies a national movement towards safeguarding exploited youth 1. However, in the context of international data privacy and the user's query referencing GDPR, the term "Safe Harbor" most likely pertains to the International Safe Harbor Privacy Principles, also known as the EU-US Safe Harbor Framework. This framework was established to govern the transfer of personal data between the European Union and the United States 4.

The user's query centers on the implications of a statement indicating that their organization only provides publicly available information under the Safe Harbor Act, particularly concerning potential derogations of privacy and violations of the General Data Protection Regulation (GDPR). This report aims to provide a comprehensive legal analysis of the GDPR implications associated with processing publicly available information, especially within the historical context of the EU-US Safe Harbor Framework. The objective is to assess the validity and potential ramifications of the user's proposed statement under current data protection regulations.

II. Historical Overview of the EU-US Safe Harbor Framework The EU-US Safe Harbor Framework emerged from the need to bridge the differing approaches to data protection between the European Union and the United States.

The European Union's Data Protection Directive (Directive 95/46/EC) generally prohibited the transfer of personal data to countries outside the European Economic Area (EEA) unless those countries ensured an adequate level of data protection 5.

Recognizing that the United States did not have an equivalent comprehensive federal privacy law, negotiations between the US Department of Commerce (DOC) and the European Commission (EC) led to the development of the Safe Harbor agreement

between 1998 and 2000 6.

The core purpose of the Safe Harbor Framework was to provide a streamlined mechanism for US organizations to receive personal data from the EU in compliance with European data protection laws 5. It allowed US companies to voluntarily self-certify their adherence to a set of seven privacy principles administered by the US Department of Commerce 6. These principles encompassed key aspects of data protection, including Notice (informing individuals about data collection and use), Choice (offering the option to opt out), Onward Transfer (ensuring adequate protection by third parties), Security (implementing reasonable security measures), Data Integrity (maintaining relevant and reliable data), Access (allowing individuals to access and correct their data), and Enforcement (providing effective means of enforcing the principles) 6. The European Commission, through a decision in 2000, recognized that US companies complying with these principles and self-certifying met the EU's adequacy requirements, thus permitting data transfers from the EU to the US 6 .

However, the Safe Harbor Framework faced increasing scrutiny, particularly following the revelations in 2013 by former American intelligence contractor Edward Snowden regarding mass surveillance programs conducted by US intelligence agencies 8. These disclosures raised significant concerns within the EU about the level of protection afforded to the personal data of EU citizens transferred to the US. Consequently, in a landmark ruling on October 6, 2015, the European Court of Justice (CJEU), in the Maximillian Schrems v. Data Protection Commissioner case (often referred to as Schrems I), declared the European Commission's Safe Harbor decision invalid with immediate effect 4. The CJEU's decision was based on the finding that the Safe Harbor agreement did not provide an adequate level of protection for personal data, primarily due to the broad access granted to US public authorities for surveillance purposes and the lack of effective legal remedies for EU citizens to challenge such surveillance 6. This invalidation underscored that the Safe Harbor framework, once a key mechanism for transatlantic data transfers, no longer held legal validity.

III. The Evolution to the EU-US Privacy Shield and the Data Privacy Framework Following the demise of the Safe Harbor Framework, the European Union and the United States sought to establish a new legal mechanism for transatlantic data transfers that would address the concerns raised by the CJEU. This led to the creation of the EU-US Privacy Shield, which was formally adopted by the European Commission on July 12, 2016 6. The Privacy Shield, similar to its predecessor, allowed US organizations to self-certify their compliance with a set of principles managed by

the US Department of Commerce 12. It aimed to provide stronger obligations on US companies regarding the protection of personal data of Europeans and included enhanced mechanisms for monitoring and enforcement by both the US Department of Commerce and the Federal Trade Commission (FTC), along with increased cooperation with European Data Protection Authorities (DPAs) 6. The Privacy Shield also incorporated commitments from the US government regarding limitations on access to personal data by public authorities for national security purposes and established a redress mechanism for EU individuals 6.

Despite these efforts, the EU-US Privacy Shield also faced legal challenges. In July 2020, the CJEU, in the Data Protection Commissioner v. Facebook Ireland and Maximillian Schrems case (commonly known as Schrems II), invalidated the Privacy Shield framework 12. The Court again cited concerns about the accessibility of personal data by US intelligence agencies and the lack of an adequate level of protection essentially equivalent to that guaranteed under EU law 12. The invalidation of both Safe Harbor and Privacy Shield created significant legal uncertainty for businesses transferring data between the EU and the US. In response to the Schrems II ruling, negotiations between the European Commission and the United States led to the agreement on a new framework: the EU-US Data Privacy Framework. This framework was agreed upon in 2022 and declared adequate by the European Commission on July 10, 2023, thereby allowing the transfer of personal data from the EU to the US based on Article 45 of the GDPR 10. The Data Privacy Framework provides a mechanism for US organizations to self-certify their compliance with a set of principles to the US Department of Commerce, committing to protect personal data transferred from the EU in a manner consistent with EU law 10. It includes stronger obligations for US companies to protect European's personal data and enhanced monitoring and enforcement by the US Department of Commerce and the Federal Trade Commission, including increased cooperation with European Data Protection Authorities 6. Furthermore, the framework incorporates commitments from the US regarding limitations on signals intelligence activities to what is necessary and proportionate and establishes a Data Protection Review Court (DPRC) to handle complaints from EU citizens regarding the collection of their data for national security purposes 12. Consequently, any statement regarding EU-US data transfers should reference the current Data Privacy Framework, not the invalidated Safe Harbor.

IV. GDPR and the Definition of Personal Data The General Data Protection Regulation (GDPR) applies to the processing of personal data of individuals within the European Union, regardless of where the data controller

or processor is located, if they offer goods or services to or monitor the behavior of EU residents 23. The cornerstone of GDPR's applicability is the definition of "personal data," which is broadly defined as any information relating to an identified or identifiable natural person 23. This includes a wide array of information, such as names, addresses, email addresses, IP addresses, cookie identifiers, and location data 23.

Crucially, the fact that personal information is publicly available does not automatically exclude it from the scope of GDPR 33. If the information relates to an identified or identifiable individual, it is generally considered personal data under GDPR, and the regulations governing its processing will apply. GDPR mandates transparency regarding the gathering and use of data, ensuring that EU citizens can exercise their right to the protection of their personal data 36. Therefore, even when personal data is obtained from publicly accessible sources, data controllers have obligations under GDPR, particularly concerning providing information to data subjects 34.

Examples of publicly available personal information can include information found in government records such as electoral rolls and court records, data accessible through publicly available databases, details shared on social media platforms, information published in media outlets, and directory listings 33. While some data privacy regulations, such as the California Privacy Rights Act (CPRA) and the Virginia Consumer Data Protection Act (VCDPA), may have broader exceptions for publicly available information compared to the original California Consumer Privacy Act (CCPA), GDPR generally maintains that public availability does not negate its applicability to personal data 38. Notably, Article 9 of GDPR outlines specific rules for processing special categories of personal data (e.g., racial or ethnic origin, political opinions), and while there are potential exemptions if the data subject has clearly made such data public and indicated their intention for further processing, this requires a clear and manifest indication from the data subject 34. Thus, the assertion that an organization only provides publicly available information does not inherently mean it is exempt from GDPR's purview if that information still constitutes personal data.

V. Processing Publicly Available Information under GDPR: Key Principles and Obligations The processing of personal data under GDPR is governed by several core principles outlined in Article 5 32. These principles apply equally to personal data obtained from public sources. The principle of lawfulness, fairness, and transparency dictates that all processing must have a lawful basis, be just, and provide clear information to

individuals about how their data is used 23. Transparency is crucial and requires concise, easily accessible information using clear and plain language 44.

The principle of purpose limitation mandates that personal data should only be collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes 32. This means that even if data is publicly available, it cannot be used for any purpose without a legitimate justification that was either initially specified or is compatible with the original context of its public availability 34. The principle of data minimization requires that the processing of personal data is adequate, relevant, and limited to what is necessary for the intended purposes 32. Furthermore, the principle of accuracy necessitates that personal data is accurate and kept up to date 32, while storage limitation dictates that data should only be kept for as long as necessary for the purposes for which it is processed 32. The principles of integrity and confidentiality require ensuring appropriate security of personal data 32, and finally, the principle of accountability holds the data controller responsible for demonstrating compliance with all these principles 32.

Beyond these core principles, GDPR imposes specific transparency obligations, particularly under Articles 13 and 14. When personal data is not obtained directly from the data subject (as is the case with publicly available information), Article 14 requires the controller to provide the data subject with specific information, including the purposes of the processing, the categories of personal data concerned, the recipients of the data, and notably, the source from which the personal data originates, including whether it came from publicly accessible sources 31. This information must be provided within a reasonable period after obtaining the data, generally within one month, or at the latest, when the data is first disclosed to another recipient 35.

Therefore, even if an organization only processes publicly available information, it still has a fundamental obligation to inform data subjects about this processing, including the source of the data.

VI. Lawful Bases for Processing Publicly Available Information Under GDPR, the processing of personal data is only lawful if it falls under one of the six lawful bases outlined in Article 6 57. These bases include: the data subject's consent; processing necessary for the performance of a contract; processing necessary for compliance with a legal obligation; processing necessary to protect the vital interests of the data subject or another natural person; processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority; and processing necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such

interests are overridden by the interests or fundamental rights and freedoms of the data subject 23.

When processing publicly available information, obtaining consent directly from the data subject for that specific processing might be challenging, although not impossible, especially if the processing goes beyond the original context in which the data was made public 23. It is important to note that simply making data public does not automatically equate to consent for any subsequent processing 34. The other bases, such as contractual necessity, legal obligation, or vital interests, might apply in specific scenarios but are less likely to be the primary basis for general processing of publicly available information. Similarly, processing in the public interest might be relevant for certain organizations with public functions.

The most likely lawful basis for many organizations processing publicly available information will be legitimate interests 31. This basis allows processing where it is necessary for the legitimate interests of the controller or a third party, provided that these interests are not overridden by the interests or fundamental rights and freedoms of the data subject 57. Relying on legitimate interests requires a careful three-part test: identifying a legitimate interest (the purpose test), demonstrating that the processing is necessary to achieve that interest (the necessity test), and balancing the controller's interests against the individual's rights and freedoms (the balancing test) 59. The legitimate interests can encompass a wide range of interests, including commercial interests and broader societal benefits 59. However, the processing must be ethical and lawful in itself to qualify as a legitimate interest 59.

Importantly, data subjects have the right to object to processing based on legitimate interests, and the controller must then cease the processing unless they can demonstrate compelling legitimate grounds that override the data subject's rights 32.

Therefore, a statement claiming to process only publicly available information is insufficient; the organization must identify and document the specific lawful basis under Article 6 that justifies this processing.

VII. Privacy Implications and Potential Derogations Even when personal data is obtained from publicly available sources, its processing can still have significant privacy implications and potentially constitute a derogation of privacy, depending on the context, purpose, and potential impact on the individuals involved. While the initial act of making information public might reduce the expectation of privacy to some extent, GDPR still protects individuals from unwarranted or unexpected processing of their personal data.

Processing special categories of personal data obtained from public sources warrants particular attention under Article 9 of GDPR 24. Generally, the processing of such sensitive data is prohibited unless specific conditions are met, such as explicit consent or another legal basis listed in Article 9 34. An exception exists if the data subject has manifestly made the data public and clearly indicated their intention for it to be further processed 34. However, this requires a very clear and unambiguous indication from the data subject.

Furthermore, processing publicly available data for purposes that are beyond what the data subject would reasonably expect can be considered a privacy violation 34. For instance, if an individual's name and address are publicly available in a phone directory, using this information for unsolicited direct marketing purposes might still be seen as intrusive and unexpected, requiring a lawful basis such as legitimate interests, which would still be subject to the balancing test and the individual's right to object. Similarly, combining personal data from various publicly accessible sources to create a detailed profile of an individual can be particularly intrusive and may lead to a significant derogation of privacy if not conducted transparently and with a valid lawful basis 35. The aggregation of seemingly innocuous pieces of publicly available information can reveal much more about an individual than the individual pieces alone.

GDPR does provide certain exceptions and derogations in specific circumstances.

Article 89 outlines safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes, subject to appropriate safeguards 66. Article 49 provides derogations for specific situations regarding international data transfers in the absence of an adequacy decision or appropriate safeguards 67. Additionally, Article 23 allows for Member State laws to restrict the scope of certain rights and obligations under GDPR in specific areas, such as national security and public safety 68. However, these derogations are specific and must be interpreted narrowly. Therefore, a general statement about processing publicly available information does not automatically invoke these exceptions. The organization must still adhere to the core principles and obligations of GDPR unless a specific derogation clearly applies to their processing activities.

VIII. Formulating a GDPR-Compliant Statement Regarding Publicly Available Information When communicating about the processing of publicly available information, organizations must prioritize accuracy and transparency to comply with GDPR

requirements 28. A simple statement indicating reliance on the "Safe Harbor Act" is insufficient and inaccurate given its invalidation. Instead, any communication should align with the current legal framework and provide comprehensive information about the processing activities. This information is typically provided in a privacy notice on the organization's website 43.

A GDPR-compliant statement regarding publicly available information should consider the following elements: ●​ Identification of the Data Controller: Clearly state the name and contact details

of the organization responsible for the processing 31. ●​ Purposes of Processing: Specify the exact reasons why the publicly available information is being collected and used 31. ●​ Lawful Basis for Processing: Clearly state the legal justification under Article 6 of GDPR, such as legitimate interests, and briefly explain the rationale, including the balancing test if applicable 31. ●​ Categories of Personal Data: Describe the types of publicly available personal information being processed (e.g., names, addresses, professional information) 31. ●​ Source of the Data: Explicitly state that the personal data is obtained from publicly accessible sources and identify these sources where possible 31. ●​ Recipients of the Data: If the data is shared with any third parties, these should be identified 31. ●​ Data Retention Period: Specify how long the data will be kept or the criteria used to determine this period 31. ●​ Data Subject Rights: Inform individuals about their rights under GDPR, including access, rectification, erasure, restriction of processing, objection, and data portability, as well as the right to lodge a complaint with a supervisory authority 31. ●​ Contact Information: Provide clear contact details for individuals to exercise their rights or ask questions about the processing 31. ●​ International Data Transfers: If personal data is transferred outside the EEA, specify the countries and the safeguards in place to protect the data 31. ●​ Automated Decision-Making: Disclose if any automated decision-making, including profiling, is involved in the processing of the publicly available information 31.

The statement should be written in clear and plain language, avoiding legal jargon, to ensure it is easily understandable by data subjects 36.

IX. Conclusion and Recommendations In conclusion, while the EU-US Safe Harbor Framework was a historical mechanism for

transatlantic data transfers, it is no longer legally valid. Therefore, any statement relying solely on this framework in the context of GDPR would be inaccurate and potentially misleading. Processing publicly available information does not automatically exempt an organization from its obligations under GDPR if that information constitutes personal data. The regulation's core principles, including lawfulness, fairness, transparency, purpose limitation, and accountability, still apply.

Furthermore, data subjects have the right to be informed about the processing of their personal data, including the source, even if it is publicly available.

To ensure GDPR compliance, the user should take the following recommendations into account: ●​ Avoid Relying Solely on the Term "Safe Harbor Act": Clarify the context and, if

applicable to EU-US data transfers, refer to the current EU-US Data Privacy Framework. ●​ Do Not Assume GDPR Exemption: Recognize that processing "publicly available information" does not automatically exempt the organization from GDPR obligations. ●​ Conduct a Privacy Impact Assessment (DPIA): If the processing of publicly available information is likely to result in a high risk to the rights and freedoms of natural persons, a DPIA should be conducted 35. ●​ Implement a GDPR-Compliant Privacy Notice: Develop a comprehensive privacy notice that provides all the necessary information to data subjects about the processing of their publicly available personal data, as outlined in Section VIII. ●​ Identify and Document the Lawful Basis: Determine and clearly document the specific lawful basis under Article 6 of GDPR that justifies the processing of the publicly available information. If relying on legitimate interests, ensure the three-part test is thoroughly conducted and documented. ●​ Establish Procedures for Data Subject Rights Requests: Ensure that the organization has clear and effective procedures in place to handle requests from individuals seeking to exercise their rights under GDPR. ●​ Regularly Review and Update Policies: Data privacy regulations and best practices evolve, so it is essential to regularly review and update data processing policies and privacy notices to maintain compliance. ●​ Seek Legal Counsel: Given the complexities of GDPR and its application to various data processing activities, it is advisable to consult with legal experts specializing in data privacy to ensure full compliance and to formulate accurate and legally sound statements.

By adhering to these recommendations, the organization can move towards a more

GDPR-compliant approach when processing publicly available information and avoid potential derogations of privacy and regulatory scrutiny.

Framework Name

Period of Validity

Key Purpose

Reason for Invalidation (if applicable)

EU-US Safe Harbor Framework

2000 - 2015

Facilitate data transfers from the EU to the US in compliance with the EU Data Protection Directive.

Invalidated by the CJEU in 2015 due to concerns about US government surveillance and lack of effective remedies for EU citizens.

EU-US Privacy Shield

2016 - 2020

Replacement for Safe Harbor, aimed at addressing CJEU concerns with stronger obligations and enforcement.

Invalidated by the CJEU in 2020 due to ongoing concerns about US surveillance and lack of essentially equivalent protection.

EU-US Data Privacy Framework

2023 - Present

Current mechanism for data transfers, relying on US companies' self-certification and US government commitments.

Lawful Basis

Brief Description

Applicability to Publicly Available Information

Consent

Freely given, specific, informed, and unambiguous agreement.

Requires explicit action by the data subject; public availability does not automatically imply consent.

Contract

Necessary for the performance of a contract with the data subject.

Less likely to be the primary basis for processing publicly available information

generally.

Legal Obligation

Necessary for compliance with a legal obligation.

May apply in specific scenarios where processing is legally mandated.

Vital Interests

Necessary to protect the life of the data subject or another person.

Less likely to be the primary basis for processing publicly available information generally.

Public Interest

Necessary for a task in the public interest or official authority.

May apply to organizations with public functions processing data for those purposes.

Legitimate Interests

Necessary for the controller's or a third party's legitimate interests, unless overridden by the data subject's rights.

Likely to be a common basis, requiring a three-part balancing test and consideration of data subject rights.

Works cited 1.​ ww2.nycourts.gov, accessed March 18, 2025,

https://ww2.nycourts.gov/ip/womeninthecourts/pdfs/MULLEN%20_HUMAN%20T RAFFICKING_1_d.pdf 2.​ Changing Course: - Creating New York State's Safe Harbour for Youth With Commercial Sexual Exploitation Experiences - OCFS, accessed March 18, 2025, https://ocfs.ny.gov/programs/human-trafficking/assets/docs/Safe-Harbour-NY-10 -Year-Report.pdf 3.​ What Is the Safe Harbor Law & What States Have It?, accessed March 18, 2025, https://www.barrywax.com/blog/what-is-the-safe-harbor-law/ 4.​ Safe harbor (law) - Wikipedia, accessed March 18, 2025, https://en.wikipedia.org/wiki/Safe_harbor_(law) 5.​ Privacy & Data Security: The Future of the US-EU Safe Harbor, accessed March 18, 2025, https://www.hunton.com/assets/htmldocuments/uploads/sites/18/2013/12/Privacy -Data-Security-The-Future-of-the-US-EU-Safe-Harbor.pdf 6.​ International Safe Harbor Privacy Principles - Wikipedia, accessed March 18, 2025, https://en.wikipedia.org/wiki/International_Safe_Harbor_Privacy_Principles 7.​ U.S.-EU Safe Harbor Framework | Federal Trade Commission, accessed March 18, 2025, https://www.ftc.gov/business-guidance/privacy-security/us-eu-safe-harbor-fram

ework 8.​ The Rise and Fall of the Safe Harbor Privacy Treaty - R Street Institute, accessed March 18, 2025, https://www.rstreet.org/commentary/the-rise-and-fall-of-the-safe-harbor-privac y-treaty/ 9.​ Examining the EU safe harbor decision and impacts for transatlantic data flows, accessed March 18, 2025, https://www.brookings.edu/articles/examining-the-eu-safe-harbor-decision-andimpacts-for-transatlantic-data-flows/ 10.​What Is the EU-US Data Privacy Framework (DPF) Program? - Termly, accessed March 18, 2025, https://termly.io/resources/articles/eu-us-data-privacy-framework/ 11.​ Data Privacy Framework | Federal Trade Commission, accessed March 18, 2025, https://www.ftc.gov/business-guidance/privacy-security/data-privacy-framework 12.​Adoption of EU/U.S. Data Privacy Framework - Byte Back, accessed March 18, 2025, https://www.bytebacklaw.com/2023/07/adoption-of-eu-u-s-data-privacy-frame work/ 13.​EU - U.S. Data Privacy Framework FAQs, accessed March 18, 2025, https://www.privacyworld.blog/data-privacy-framework-faq/ 14.​EU-US Privacy Shield; Safe Harbor; & GDPR - Traverse Legal, accessed March 18, 2025, https://www.traverselegal.com/blog/us-eu-privacy-shield-safe-harbor-gdpr/ 15.​FAQs: EU-US data privacy framework approved, accessed March 18, 2025, https://www.simmons-simmons.com/en/publications/cljzyp71500uotpz0xj8mligj/f aqs-eu-us-data-privacy-framework-approved 16.​What does the Safe Harbor Ruling Mean for Your Analytics? - Piwik PRO, accessed March 18, 2025, https://piwik.pro/blog/what-does-the-safe-harbor-ruling-mean-for-your-analytic s/ 17.​International data-sharing norms: from the OECD to the General Data Protection Regulation (GDPR) - PMC - PubMed Central, accessed March 18, 2025, https://pmc.ncbi.nlm.nih.gov/articles/PMC6132662/ 18.​First Safe Harbor, then Privacy Shield: What EU-US data-sharing agreement is next?, accessed March 18, 2025, https://www.infosecinstitute.com/resources/management-compliance-auditing/fi rst-safe-harbor-then-privacy-shield-what-eu-us-data-sharing-agreement-is-ne xt/ 19.​EU–US Data Privacy Framework - Wikipedia, accessed March 18, 2025, https://en.wikipedia.org/wiki/EU%E2%80%93US_Data_Privacy_Framework 20.​EU-U.S. Data Privacy Framework (DPF), accessed March 18, 2025, https://www.dataprivacyframework.gov/Program-Overview 21.​Data Privacy Framework, accessed March 18, 2025, https://www.dataprivacyframework.gov/ 22.​EU-US Data Privacy Framework Principles, accessed March 18, 2025,

https://www.dataprivacyframework.gov/EU-US-Framework 23.​What is GDPR, the EU's new data protection law?, accessed March 18, 2025, https://gdpr.eu/what-is-gdpr/ 24.​Guidance for EU General Data Protection Regulations (GDPR) compliance in the conduct of human research. - Institutional Review Board (IRB) Office, accessed March 18, 2025, https://irb.northwestern.edu/resources-guidance/policies-guidance/docs/guidanc e-for-general-data-protection-regulations-gdpr-compliance---general---19171. pdf 25.​Personal Data - General Data Protection Regulation (GDPR), accessed March 18, 2025, https://gdpr-info.eu/issues/personal-data/ 26.​Personal Data Under the General Data Protection Regulation (GDPR) - Inspired eLearning, accessed March 18, 2025, https://inspiredelearning.com/blog/gdpr-personal-data/ 27.​What Is Personal Information Under Data Privacy Laws - Termly, accessed March 18, 2025, https://termly.io/resources/articles/personal-information/ 28.​Data protection explained - European Commission, accessed March 18, 2025, https://commission.europa.eu/law/law-topic/data-protection/data-protection-exp lained_en 29.​General Data Protection Regulation - NYU, accessed March 18, 2025, https://www.nyu.edu/research/resources-and-support-offices/getting-started-wi thyourresearch/human-subjects-research/forms-guidance/EUGDPR.html 30.​Art. 4 GDPR – Definitions - General Data Protection Regulation (GDPR), accessed March 18, 2025, https://gdpr-info.eu/art-4-gdpr/ 31.​GDPR Statement | The University of Alabama, accessed March 18, 2025, https://www.ua.edu/gdpr-statement/ 32.​Art. 5 GDPR – Principles relating to processing of personal data, accessed March 18, 2025, https://gdpr-info.eu/art-5-gdpr/ 33.​Publicly Available Personal Information - JoinDeleteMe, accessed March 18, 2025, https://joindeleteme.com/glossary/publicly-available-personal-information/ 34.​GENERAL INFORMATION ON HOW TO PROCESS PUBLICLY AVAILABLE DATA IN COMPLIANCE WITH GDPR - Solak Partners, accessed March 18, 2025, https://solakpartners.com/general-information-on-how-to-process-publicly-avail able-data-in-compliance-with-gdpr/ 35.​What common issues might come up in practice? | ICO, accessed March 18, 2025, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-r ights/the-right-to-be-informed/what-common-issues-might-come-up-in-practi ce/ 36.​Right to be Informed - General Data Protection Regulation (GDPR), accessed March 18, 2025, https://gdpr-info.eu/issues/right-to-be-informed/ 37.​Art. 14 GDPR – Information to be provided where personal data have not been obtained from the data subject - General Data Protection Regulation (GDPR), accessed March 18, 2025, https://gdpr-info.eu/art-14-gdpr/ 38.​How do the CPRA, CPA & VCDPA treat publicly available information? | Byte Back, accessed March 18, 2025,

https://www.bytebacklaw.com/2022/01/how-do-the-cpra-cpa-vcdpa-treat-publi cly-available-information/ 39.​Art. 9 GDPR – Processing of special categories of personal data, accessed March 18, 2025, https://gdpr-info.eu/art-9-gdpr/ 40.​Principles of Data Protection, accessed March 18, 2025, http://www.dataprotection.ie/en/individuals/data-protection-basics/principles-dat a-protection 41.​Quick Guide to the Principles of Data Protection, accessed March 18, 2025, https://www.dataprotection.ie/sites/default/files/uploads/2019-11/Guidance%20on %20the%20Principles%20of%20Data%20Protection_Oct19.pdf 42.​Data Protection Principles: Core Principles of the GDPR - Cloudian, accessed March 18, 2025, https://cloudian.com/guides/data-protection/data-protection-principles-7-core-p rinciples-of-the-gdpr/ 43.​Your essential guide to crafting a compliant privacy notice (GDPR) - Thoropass, accessed March 18, 2025, https://thoropass.com/blog/compliance/privacy-notice-gdpr/ 44.​A breakdown of the GDPR's six data processing principles - IT Governance, accessed March 18, 2025, https://www.itgovernance.eu/blog/en/a-breakdown-of-the-gdprs-six-data-proce ssing-principles 45.​Principle (a): Lawfulness, fairness and transparency | ICO, accessed March 18, 2025, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-prote ction-principles/a-guide-to-the-data-protection-principles/lawfulness-fairness-a nd-transparency/ 46.​Lawfulness, fairness and transparency | Data Protection Ombudsman's Office Tietosuojavaltuutetun toimisto, accessed March 18, 2025, https://tietosuoja.fi/en/lawfulness-fairness-and-transparency 47.​Lawful, fair and transparent processing | ICO, accessed March 18, 2025, https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic -communications/guidance-for-the-use-of-personal-data-in-political-campaigni ng-1/lawful-fair-and-transparent-processing/ 48.​GDPR compliance checklist - GDPR.eu, accessed March 18, 2025, https://gdpr.eu/checklist/ 49.​What Is GDPR Compliance? - Palo Alto Networks, accessed March 18, 2025, https://www.paloaltonetworks.com/cyberpedia/gdpr-compliance 50.​Art. 32 GDPR – Security of processing - General Data Protection Regulation (GDPR), accessed March 18, 2025, https://gdpr-info.eu/art-32-gdpr/ 51.​Secure personal data | European Data Protection Board - European Union, accessed March 18, 2025, https://www.edpb.europa.eu/sme-data-protection-guide/secure-personal-data_e n 52.​Art. 13 GDPR – Information to be provided where personal data are collected from the data subject - General Data Protection Regulation (GDPR), accessed

March 18, 2025, https://gdpr-info.eu/art-13-gdpr/ 53.​Right to be informed | ICO, accessed March 18, 2025, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-r ights/individual-rights/right-to-be-informed/ 54.​How should we draft our privacy information? | ICO, accessed March 18, 2025, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-r ights/the-right-to-be-informed/how-should-we-draft-our-privacy-information/ 55.​Writing a GDPR-compliant privacy notice (template included), accessed March 18, 2025, https://gdpr.eu/privacy-notice/ 56.​GDPR Privacy Notice or Consent - Institutional Compliance and Ethics, accessed March 18, 2025, https://www.boisestate.edu/compliance/eu-gdpr/privacy-notice-or-consent/ 57.​Art. 6 GDPR – Lawfulness of processing - General Data Protection Regulation (GDPR), accessed March 18, 2025, https://gdpr-info.eu/art-6-gdpr/ 58.​Consent - General Data Protection Regulation (GDPR), accessed March 18, 2025, https://gdpr-info.eu/issues/consent/ 59.​What is the 'legitimate interests' basis? | ICO, accessed March 18, 2025, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basi s/legitimate-interests/what-is-the-legitimate-interests-basis/ 60.​A Guide to Understanding Legitimate Interest in 2024 - Clym, accessed March 18, 2025, https://clym.io/blog/a-guide-to-understanding-legitimate-interest-in-2024 61.​What Is Legitimate Interest Under the GDPR? - IT Governance, accessed March 18, 2025, https://www.itgovernance.eu/blog/en/the-gdpr-legitimate-interest-what-is-it-an d-when-does-it-apply 62.​Five key takeaways from recent EU developments on the GDPR's “legitimate interests” legal basis | Inside Privacy, accessed March 18, 2025, https://www.insideprivacy.com/data-privacy/five-key-takeaways-from-recent-eu -developments-on-the-gdprs-legitimate-interests-legal-basis/ 63.​Legal Disclaimer and Data Protection - ingenit, accessed March 18, 2025, https://www.ingenit.com/en/legal-disclaimer-and-data-protection 64.​GDPR Legitimate Interests - GDPR EU, accessed March 18, 2025, https://www.gdpreu.org/the-regulation/key-concepts/legitimate-interest/ 65.​When can we rely on legitimate interests? | ICO, accessed March 18, 2025, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basi s/legitimate-interests/when-can-we-rely-on-legitimate-interests/ 66.​Article 89 EU GDPR "Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes", accessed March 18, 2025, https://www.privacy-regulation.eu/en/article-89-safeguards-and-derogations-rel ating-to-processing-for-archiving-purposes-the-public-interest-scientific-or-hiGDPR.htm?ref=1ba4110 67.​Art. 49 GDPR – Derogations for specific situations - General Data Protection Regulation (GDPR), accessed March 18, 2025, https://gdpr-info.eu/art-49-gdpr/ 68.​General Data Protection Regulation Derogations - GDPR Resource Center,

accessed March 18, 2025, https://gdpr.lw.com/Home/Derogations 69.​GDPR Privacy Notice Examples | Secureframe, accessed March 18, 2025, https://secureframe.com/hub/gdpr/privacy-notice 70.​A guide to GDPR data privacy requirements - GDPR.eu, accessed March 18, 2025, https://gdpr.eu/data-privacy/ 71.​Writing a GDPR compliance statement - Free Checklist - Cyphere, accessed March 18, 2025, https://thecyphere.com/blog/gdpr-statement/ 72.​GDPR Compliance Statement - Privacy Policies, accessed March 18, 2025, https://www.privacypolicies.com/blog/gdpr-compliance-statement/ 73.​GDPR Compliance Statement - Free Privacy Policy Generator, accessed March 18, 2025, https://www.freeprivacypolicy.com/blog/gdpr-compliance-statement/ 74.​Disclaimer and GDPR - HECATE Project, accessed March 18, 2025, https://hecate-project.eu/disclaimer-and-gdpr/