Actually it does. The only lawful base for processing in this case is legitimate interest. The working paper (WP251) specifically states "it would be difficult

Actually it does. The only lawful base for processing in this case is legitimate interest. The working paper (WP251) specifically states "it would be difficult for controllers to justify using legitimate interests as a lawful basis for intrusive profiling". Regarding the "manifestly made public" I was under the impression that a laymans twitter feed with 10 followers would not fall under "manifestly made public". As soon as the profiling starts inferring from data (say homosexuality) you definitively go off the rails. I do have some professional exposure to GDPR and the way compliance lawyers treat GDPR, profiling etc. So if I'm really of the charts, please point it out, but these firms behaviour would be behaviour I would warn against internally. I wouldn't touch externally built profiles with a 10ft pole.