Dutch DPA's Guidelines on Data Scraping. Key takeaways: - Legitimate interest is probably the only legal basis a company can use to scrape data (even if the data is publicly available and you remove it right after the collection); - Data scraping cannot be considered a compatible purpose for further data collection and processing, but new processing, so you need to think about a valid legal basis; - If your interest is purely commercial ("non-legally protected" commercial interest, which is unclear, but probably something the DPA earlier stated in the VoetbalTV case: "legitimate interest must follow from the law but cannot be purely commercial", which was considered as unfounded), or you don't have other non-commercial purposes (e.g., fraud prevention, improving the security of your computer systems, etc.), you cannot rely on the legitimate interest as a legal basis (e.g., if your goal is to train GenAI models or to create profiles of involved individuals and then resell them, you'll likely not rely on the LI, but if your scrape public online forums about information security to visualize security risks to one's organization, is OK to use LI); - Before scraping the data, consider the consequences and potential harms of the planned processing and whether the individuals whose data is involved will have reasonable expectations for that. For example, scraping the data to determine whether or not new employees should be hired based on their expressions on social media creates a significant impact; - Remember to add sufficient transparency about the processing you perform; deleting, pseudonymizing, or anonymizing the data as soon as possible; honor data erasure requests; use robots exclusion protocol; When dealing with special categories of data and considering whether the "manifest disclosure" exception to the data processing prohibition applies, consider whether the individual actively took action to make the data public (e.g., if the default settings in a social media platform are private and the data is publicly available, then you can consider it an exception). #privacy #GDPR
And then to know that the Dutch DPA seems to have a problem defining legitimate interest properly, with that added your first key point becomes very interesting.
Data Management & Data Protection | ex-HSBC | ex-ING | Imperial College | Financial Services Regulatory Compliance Change Management
2moWhat about adhering to the terms of use of where the data is being stored? What about sharing the privacy notice with data subjects at the time of collection?