There is a better basis, one that covers even sensitive data under Article 9. Specifically, the processing is lawful when "processing relates to personal data which are manifestly made public by the data subject" [1], as is the case here.

[1] https://gdpr-info.eu/art-9-gdpr/