Processing personal data manifestly made public by the data subject : a critical legal analysis of Article 9(2)(e) of the GDPR

Abstract

Processing of special categories of personal data is generally prohibited under the GDPR, subject to limited derogations under Article 9(2). This dissertation offers a critical legal analysis of Article 9(2)(e), which concerns data ‘manifestly made public by the data subject’, and asks whether its current and emerging interpretations safeguard data subjects’ fundamental rights or risk eroding the protection afforded by Article 9 as a whole. Employing a primarily doctrinal method, supplemented by critical analysis, the study examines the wording, structure and objectives of Article 9(2)(e) in light of Articles 6 and 9 GDPR and the CFR, and engages with academic commentary, CJEU case law, AG Opinions, EDPB and WP29 guidance, and the enforcement practice of national supervisory authorities. Particular attention is devoted to the threshold implied by ‘manifestly’, the meaning of ‘public’, and the requirement that publicity be attributable to the data subject, with a focus on online environments, platform design, and reasonable expectations. The dissertation argues that a narrow, context-sensitive interpretation of Article 9(2)(e) is required: ‘manifestly made public’ demands an explicit, informed and deliberate act by the data subject to make special category data accessible to an indeterminate public, and cannot be inferred from mere online accessibility, default settings, largescale tracking or scraping. Applied to contemporary AI practices, the analysis concludes that reliance on Article 9(2)(e) to justify web-scale scraping of special category data for training LLMs is generally incompatible with the GDPR’s lawfulness, fairness and purpose limitation requirements, save for tightly bounded opt-in schemes with genuine transparency and control. A more restrictive reading of the derogation, anchored in fundamental rights and accountability, is therefore necessary to prevent it from becoming a loophole for intrusive secondary uses of sensitive data.