OSINT and personal data

This guide gives practical bearings, it does not replace a lawyer’s advice. For sensitive or large-scale processing, have your approach reviewed.

Public does not mean free to use

This is the most widespread misreading. The fact that information is reachable does not take it out of the law. As soon as it concerns an identifiable natural person, directly or indirectly, it remains personal data, and collecting it constitutes processing under the General Data Protection Regulation.

The name of a director published in a company register is personal data. An email address found on a website is personal data. A handle traceable back to someone is too.

What the public character changes: it makes access lawful. What it does not change: your obligations once the information is in your hands.

You need a legal basis

Processing must rest on one of the bases the regulation provides. For an investigation, two come up most often.

Legitimate interest. This is the usual basis for a counterparty check or an internal enquiry. It assumes you have written down three things: the interest pursued, the fact that the processing is necessary to achieve it, and the balance between that interest and the rights of the people concerned. That document is prepared beforehand, not afterwards.

Legal obligation. This applies when a text requires the check, for instance in anti-money-laundering work.

Journalism is a different case and benefits from specific accommodations, set out further down.

Collect only what serves

The minimisation principle says data must be adequate, relevant and limited to what is necessary. Translated into an investigation map, that means three things.

• An entity that answers no question in the file has no business being there.
• A person’s private life does not belong in an investigation about a company, unless a link to the subject is demonstrated.
• Special categories of data, such as health, political opinions, religion or sexual orientation, fall under a markedly stricter regime. In practice, keep them out of the file.

A tight file is legally sounder, and it is also more readable. Both requirements pull in the same direction.

How long to keep it

A retention period must be set in advance and respected. There is no universal duration: it follows from the purpose.

In practice, distinguish three moments. During the investigation, you keep whatever serves. At closure, you purge what brought nothing and archive what founds your conclusions. Once the period you set has passed, you delete the archive.

Writing that rule down somewhere beats deciding case by case.

The rights of individuals

Anyone appearing in your processing has rights: access, rectification, erasure, objection, restriction. They are exercised with the controller, subject to exceptions and deadlines you want to know before the first request arrives.

Two practical consequences for an investigation map. You must be able to find every piece of data relating to a person, which assumes your file is organised rather than scattered. And you must be able to remove one without demolishing the rest of the work.

The journalism case

Processing for journalistic purposes benefits from accommodations meant to reconcile data protection with freedom of expression and information. Those accommodations do not remove every obligation, they adapt how it applies.

A newsroom has an interest in formalising its own doctrine: what it collects, why, for how long, and who decides. That is useful legally, and it is useful on the day a story is challenged.

What it changes on a map

Four habits are enough to stay within bounds, and they improve the work along the way.

1. Record the source and the date in each entity’s fields. That is the trace of lawful collection, and it is what makes your file defensible.
2. Separate facts from hypotheses, by naming links precisely. A cautious statement commits you to less than an unsupported categorical one.
3. Keep the file under your control. The less it circulates, the smaller the exposure. A tool that works locally, like this one, mechanically limits how far it spreads.
4. Know how to delete. An entity and its links must be able to disappear cleanly, without leaving residue elsewhere.

Going further

The French data protection authority publishes practical notes on legitimate interest, minimisation and retention periods. Those are the references to consult before setting your own doctrine.