Public data still has rules

Access and reuse are different questions

The EU Open Data Directive promotes reuse of public-sector information and identifies companies and company ownership as a high-value category. [3] It does not make every document unrestricted or override data protection, intellectual property, confidentiality, or source-specific conditions.

Public data can contain personal data

Company roles, sole-trader records, notices, and other public sources may identify people. Processing therefore needs a defined purpose, an applicable legal basis, data minimization, retention rules, security, and a way to handle data-subject rights.

IMY explains that legitimate interests require a necessary and clearly stated purpose and a balancing assessment against the individual's rights. A less intrusive way to achieve the same result should be used when available. [4]

Predictions need context

The legal treatment of an AI system depends on its intended purpose and use. [5] A signal used to prioritize manual research is not the same as an automated decision about a person. Customers need to understand the intended use, inputs, confidence, and limits.

Responsible practice

• •Collect only what the defined purpose needs.
• •Separate source facts from personal information and modelled signals.
• •Record source terms and collection dates.
• •Respect API identification and rate-limit rules. [7]
• •Avoid consequential decisions based on one source or one score.

This guide explains general principles, not legal advice. The correct assessment depends on the sources, fields, customer, purpose, and jurisdiction of a specific delivery.