Whether PII is publicly available or not doesn't matter, they are still processing and storing it without consent. This works differently from "expectation of p

Whether PII is publicly available or not doesn't matter, they are still processing and storing it without consent. This works differently from "expectation of privacy" in the US, for example, where often anything is fair game as long as you can trace it back to a public space. You could literally staple your business card to your building's front door and they can't use it without explicit consent. Heck, the other day I called my legal insurance and the lawyer they referred me to initiated the conversation with reading out a GDPR disclosure because he needed my insurance number and needed to sync it with the insurance company (a third party), which meant transferring PII.