Scraping is the automatic collection and storage of information from the Internet. Scraping by private parties and individuals is almost never allowed. So says the Autoriteit Persoonsgegevens (AP) in a new manual. In practice, those parties can only use scraping legally if they do so in a very targeted way.
In scraping, a computer program automatically "scrapes" data from the Internet. For example, by scanning social media. Scraping almost always collects personal data. This creates privacy risks. Scraping can collect personal data from a large number of people in a short period of time. The information captured in scraping can be about numerous aspects of a person's life. The information may also include all kinds of special personal data and criminal records, which usually should not be collected and used.
Scraping will almost always be a violation of the General Data Protection Regulation (GDPR). In some cases, scraping is not allowed anyway. For example:
scrape the Internet to create profiles of people, then resell them;
scrapping information from protected social media accounts or private forums;
scrape data from public social media profiles for the purpose of determining whether or not those people will receive a requested insurance policy.
The AP's guidance is not aimed at the government. But government scraping also has significant privacy risks and is subject to strict rules. The AP is also working on a guide for government scraping.
A widespread misunderstanding is that scraping would be allowed, because everything on the Internet can be viewed by anyone anyway. 'But the fact that information about you is public does not automatically mean that you give permission for scraping,' says AP chairman Aleid Wolfsen. Even if you post on your social media account that you recently won the lottery or had an operation, you are not giving permission for that data to be scraped. You only give permission to collect personal data if you have been asked beforehand. That's usually impossible to do with scraping.
In practice, scraping by private organizations and individuals is possible only on the basis of the legitimate interest basis. Strict conditions apply to that basis. For example, scraping may not be used with the sole interest of making money from it. It is almost never possible for scraping to meet these conditions.
In exceptional cases, though, scraping may be allowed. For example, in "domestic use": if an individual uses scraping for a hobby project and only shares the results with some friends, the AVG does not apply and it is allowed. Scraping may also be allowed when it is highly targeted. For example, when an organization scrapes the websites of news media in order to get relevant news about its own company in focus.
Download the handout here: https://www.autoriteitpersoonsgegevens.nl/system/files?file=2024-05/Handreiking%20scraping%20door%20particulieren%20en%20private%20organisaties.pdf
