CZ3 · Course Zero |
Legal Framework · UK GDPR |
|||||||
ICO Guide · DPA 2018 · Collection Log · Balancing Test | ||||||||
Foundational | ||||||||
Investigating yourself: the OSINT dry run on your own digital footprint. See also: Neutral language cheatsheet and court record research for the companion standards this framework is applied alongside. |
|
OSINT practitioners operate under data protection law the moment they collect information about an identifiable living person. Under UK GDPR, collection is lawful only with a named basis in Article 6. For journalism and public-interest investigation, that basis is almost always legitimate interests under Article 6(1)(f), qualified by the journalism exemption in Schedule 2 Part 5 of the Data Protection Act 2018. The exemption is conditional, not absolute: it protects processing for publication, not for private use.
Defensible collection means three things: naming the lawful basis before you start, keeping scope proportionate to the investigative question, and being able to explain after the fact why each piece of data was necessary. This tutorial walks one investigation type end to end, a named individual suspected of corporate wrongdoing, and produces a decision flowchart you can apply the same way every time.
Learning outcomes
By the end of this tutorial you will be able to:
Name the correct Article 6 UK GDPR lawful basis for OSINT collection before any processing begins
Apply the three-part legitimate interests balancing test in writing and record it to a defensible standard
Identify which GDPR provisions the journalism exemption disapplies, and under what conditions
Produce a collection log that documents scope, basis, exclusions and stop condition for a single investigation
Recognise when collection has become disproportionate and apply the stop condition