GDPR doesn't work like that, the means of obtaining the data does not relate to the legal basis you have for processing it. If you process personal data you ne

GDPR doesn't work like that, the means of obtaining the data does not relate to the legal basis you have for processing it. If you process personal data you need at least one legal basis, you decide what that is and you take on certain obligations. If you rely on "legitimate interest" GDPR requires you to consider the balance of your interest versus the subject's right to privacy. As long as you do so, record your determination and take reasonable steps to mitigate the privacy impact - such as allowing opt out, aging the data out over time etc - and you make good on your obligations it is unlikely an enforcement agency will find against you. It is a subjective decision however and there haven't been many GDPR cases handled by member states yet, so interpretations might change over time and all you can go on is guidance from regulators presently. I think a good example of where scraping and legitimate interest would be ok is if you are trying to sell a product appropriate to people with <job title>. You go to LinkedIn, pay for a facility that allows you to search for that job title, scrape that data and attempt to contact those people. There is some privacy impact but it is likely that people who make themselves available on a business networking site might reasonably expect to be contacted about things relevant to their job title. As long as they can opt out from your processing of their data and you don't keep it for longer than necessary and meet the other obligations you'll likely be fine (notwithstanding the ePrivacy directive which is a separate thing). An example where your grounds might be a lot more tenuous would be a recruitment agent scraping your name from a question on StackOverflow and guessing your email address to contact you about a job. In your Amazon review example, the processor would need to justify capturing your name. For most processing purposes (eg grouping the reviews by author) a hash would suffice.