A platform scrapes publicly posted EU user content from the open web to train machine-learning models without informing those individuals or establishing a clear lawful basis. Which statement is correct?
Select an answer to reveal the explanation.
Short Explanation
Public is not the same as free-for-all. A post on the open web can still be personal data, and vacuuming it into an ML corpus still needs a legal story and some transparency. Visibility online does not delete GDPR.
Full Explanation
Recital and definitional materials make clear that personal data available from public sources are still personal data. Further processing for ML training is a purpose that must satisfy Art. 6 (and Art. 9 if special categories appear), respect purpose limitation and fairness, and meet transparency expectations where applicable. Controllers cannot assume that public posting equals unlimited reuse without legal analysis.