Cybersecurity Policy Report, Dutch DPA Issues Data-Scraping Guidance, (May 1, 2024)

By Tony Foley

The Dutch data protection authority, Autoriteit Persoonsgegevens (AP), announced today that it had developed guidance regarding the use of data-scraping techniques by private parties and individuals.

In a news release, AP said the practice of data-scraping, in which a computer program harvests data from the Internet, was almost never allowed under the European Union’s General Data Protection Regulation (GDPR). Data-scraping often includes scanning public social media accounts and almost always collects personal data, creating significant privacy risks. The information also may include special category data and criminal data, neither of which generally may be collected or used without consent.

The guidance, which may be downloaded from the news release but is available only in Dutch, specifies that data-scraping almost always constitutes a GDPR violation. Specific types of scraping, including to create and resell profiles, as well as scraping of protected social medial accounts or privacy forums and scraping of public social media profiles with the aim of determining whether or not the data subject will receive requested insurance, are not permitted. AP added that, while the guidance was not aimed at the government, data-scraping by government also presented risks and was subject to strict rules.

Citing what he called a widespread misunderstanding that scraping was allowed because everything on the Internet was public, AP Chair Aleid Wolfsen emphasized that publicity did not constitute consent. “[T]he fact that information about you is public does not automatically mean that you also give permission for scraping,” he said. “Even if you post on your social media account that you recently won the lottery or had an operation, you do not give permission for that data to be scraped. You only give permission to collect personal data if you have been asked in advance. That is usually not possible with scraping.”

The guidance provides in general that scraping by private organizations and individuals is allowed only on the basis of data processing for a legitimate interest, which is subject to strict conditions. As an example, AP said scraping would never be allowed for the sole purpose of making money. That said, AP acknowledged that scraping might be allowable under certain circumstances, such as in a case where the scraper used the technology for a domestic purpose and only shared the data with a few friends, in which case the GDPR requirements would not apply. Scraping also may be allowable if used in a very targeted manner, as when an organization scrapes the websites of news media to gain insight into relevant news about its own company.

News: InternationalLegislation DataPrivacy GDPR