With scraping, a computer program automatically ‘scrapes’ data from the Internet. For example, by scanning social media. Scraping almost always collects personal data. This creates privacy risks. Scraping can collect personal data from many people in a short time. The information recorded during scraping can relate to many aspects of a person’s life. The information may also contain all kinds of special personal data and criminal personal data, which are usually not allowed to be collected and used.
GDPR violation
Scraping will almost always be a violation of the General Data Protection Regulation (GDPR). In a number of cases, scraping is not allowed anyway. For example:
- scraping the internet to create profiles of people and then resell them;
- scraping information from protected social media accounts or private forums;
- scraping data from public social media profiles, with the aim of determining whether or not those people will receive requested insurance.
The AP’s guidance is not aimed at the government. But scraping by the government also has major privacy risks and is subject to strict rules. The AP is also working on a guideline for scraping by the government.
Publicity is not consent
A widespread misunderstanding is that scraping is allowed, because everything on the internet is already available to everyone. “But the fact that information about you is public does not automatically mean that you also give permission for scraping,” says AP chairman Aleid Wolfsen. ‘Even if you post on your social media account that you recently won the lottery or had an operation, you do not give permission for that data to be scraped. You only give permission to collect personal data if you have been asked in advance. That is usually not possible with scraping.’
Almost never possible
In practice, scraping by private organizations and private individuals is only possible on the basis of legitimate interest. Strict conditions apply to this basis. For example, scraping should not be used for the sole purpose of making money. It is almost never possible to meet these conditions when scraping.
Exceptions
In exceptional cases, scraping may be permitted. For example, in the case of ‘domestic use’: when a private individual uses scraping for a hobby project and only shares the results with a few friends, the GDPR does not apply and it is allowed. Scraping may also be permitted if it is used in a very targeted manner. For example, when an organization scrapes the websites of news media to gain insight into relevant news about its own company.
