The exception for publicly available information, including public records, is a common factor used to limit the scope of data protection laws. This factor recognizes that certain types of personal information are already in the public domain and therefore may not require the same level of protection as private data.

Provision Examples:

"Personal information" does not include publicly available information or lawfully obtained, truthful information that is a matter of public concern. For purposes of this paragraph, "publicly available" means: information that is lawfully made available from federal, state, or local government records, or information that a business has a reasonable basis to believe is lawfully made available to the general public by the consumer or from widely distributed media; or information made available by a person to whom the consumer has disclosed the information if the consumer has not restricted the information to a specific audience." (CCPA Sec.1798.140 (v)(2), USA - California)

"Subject to the provisions of this Act, it shall— (c) not apply to— (ii) personal data that is made or caused to be made publicly available by— (A) the Data Principal to whom such personal data relates; or (B) any other person who is under an obligation under any law for the time being in force in India to make such personal data publicly available." (DPDP Art.3(c)(ii), India)

Description

The exception for publicly available information is incorporated into data protection laws to balance the need for privacy protection with the practical realities of information that is already in the public domain. This factor recognizes that certain types of personal data are inherently public or have been intentionally made public, and therefore do not require the same level of protection as private information.The rationale behind this exception includes:

1. Avoiding unnecessary restrictions on the use of already public information.
2. Recognizing the individual's choice to make their information public.
3. Facilitating the use of public records for legitimate purposes, such as research or journalism.

Implications

This exception has several implications for businesses:

1. Use of public records: Companies can generally use information from public government records without violating data protection laws. For example, a real estate company could use publicly available property records without obtaining consent from property owners.
2. Social media information: If a user makes their social media profile public, a company might be able to use that information for marketing purposes without violating data protection laws. However, businesses should be cautious, as the definition of "publicly available" can vary by jurisdiction.
3. Published information: News organizations or researchers might be able to use personal information that has been lawfully published in widely distributed media without additional consent.
4. Limitations on the exception: Businesses should be aware that even if information is publicly available, there may be restrictions on how it can be used. For instance, under the CCPA, biometric information collected without knowledge is not considered public even if from a public source.