‘Publicly available’ in relation to personal data about an individual, means personal data that is generally available to the public. This includes personal data which can be observed by reasonably expected means at a location or an event – (a) at which the individual appears; and (b) that is open to the public.
An organisation need not obtain consent for the collection, use or disclosure of personal data that is publicly available but may still have to comply with other obligations under the PDPA.
Can an organisation collect, use or disclose publicly available personal data for any purposes?
While an organisation may not obtain consent for the collection, use or disclosure of personal data that is publicly available, it may still have to comply with all other obligations under the PDPA.
In particular, the PDPA provides that an organisation may collect, use or disclose personal data about an individual only for purposes that a reasonable person would consider appropriate in the circumstances. In this regard, the circumstances would need to be taken into account in determining whether the purpose is appropriate.
Given that publicly available personal data is already made available to the public, the PDPC recognises that for the purposes of the PDPA, it would not be practical nor useful to unduly limit the purposes for which such data can be collected, used or disclosed, unless it is for clearly unreasonable purposes, for example, the purpose is in violation of a law or would be harmful to the individual concerned.
In any case, organisations should note that their collection, use or disclosure of personal data from publicly available sources may be bound by terms and conditions imposed and enforceable by the data source.