The provisions of the law apply regardless of whether certain personal data were previously made public.

Hence, if the controller intends to process personal data, it must have an appropriate legal basis for the processing in accordance with Article 10 of the GDPR.

Also, since the personal data is not obtained directly from the personal data subject, the controller must provide to the personal data subjects all the information prescribed in Article 18 of the ZZLP (eg, who is the source of the data).