GDPR personal data is anything relating to an identifiable person. It’s not an expectation of privacy standard. Data gathered by observing you in public is protected the same as data you share with the controller in confidence.