This is not legal advice and cannot be: the rules differ by country and by the capacity you are acting in. What is set out here is where this association stops, and the reasoning is worth having whatever jurisdiction you work in.
Not touched, ever:
- Anything behind a login you were not given. Including an account somebody else created, and including one obtained by asking a colleague for their password.
- Private messages and closed groups. A group with a membership control on it is closed however easy joining would be.
- Leaked and breached data. It circulates freely and is often offered as a legitimate dataset. Using it makes every finding unusable and, in much of Europe, makes the processing itself unlawful.
- Anything reached by defeating a control. CAPTCHAs, rate limits, paywalls and access restrictions are all statements that you are not invited.
And two that catch careful people out:
Publicly visible is not the same as free to process. In the EU and the UK, personal data that is published still has a data subject with rights. Being able to see something and being permitted to collect, store and combine it are different questions.
Combining is itself an act. Three harmless public facts assembled into a person's daily movements is a new thing, and it is the assembly that creates the risk — not any one of the parts.
The test that catches most of it: could you write down exactly how you obtained this, hand it to the person it concerns, and defend it? If not, do not do it.