Data scraping: ICO’s first attempt at legal clarity

Data scraping or “web scraping” has various definitions but essentially means the process of gathering, copying or extracting information (including text, images and videos and therefore often personal data) from the internet with a view to storing that information and using it (or selling it for use).  It can include text, images and videos and has many beneficial use cases such as fraud prevention or the training of AI models. 

As part of a scraping exercise, potentially large volumes of personal data can be processed and so both “scraper” and “user” (i.e. the scraper’s customer) should consider their data protection compliance. This is important - the ICO and EU regulators will not shy away from enforcement action in this area (for example against Clearview AI) - but isn’t necessarily straightforward, as evident in the ICO’s recent consultation on the use of scraped data to train Gen AI models (see our blog for more detail). 

We have written an article, first published for Privacy Laws & Business, touching on the key challenges of a data scraping exercise. These include:

• challenges around the lawful basis requirement (particularly the legitimate interest ground);
• how to approach transparency and fairness; and
• issues with the general lawfulness principle, for example because a scraping exercise could result in breaches of copyright laws and website terms and conditions.

Given the potential benefits of data scraping, many organisations will welcome the first steps by the ICO and other regulators around the world to provide the necessary clarity to enable them to address the compliance challenges. This should ultimately encourage innovation without compromising data subjects’ fundamental rights, although we have some way to go before the regulatory approach is settled and businesses have the legal certainty they need.