DATA PROTECTION
Artificial Intelligence: the Italian Data Protection Authority Issues Guidance to Protect Personal Data from Web Scraping.
The Italian Data Protection Authority (Garante) has issued guidance on how to protect personal data published online by public and private entities in their capacity as data controllers from web scraping, i.e. the indiscriminate collection of personal data on the internet, carried out by third parties for the purpose of training generative artificial intelligence (GAI) models. The guidance reflects the contributions obtained by the Garante as part of its fact-finding investigation, approved last December.
While waiting to decide – following the outcome of a number of investigations already under way, including the one against OpenAI - on the lawfulness of web scraping of personal data performed on the basis of legitimate interest, the Garante deemed it necessary to provide data controllers who publish personal data online with initial guidance on the need to adopt appropriate security measures to prevent or, at least, hinder web scraping.
In the guidance document, the Garante suggests a number of concrete measures to be adopted: the creation of reserved areas, accessible only upon registration, so as to remove data from public availability; the inclusion of anti-scraping clauses in the terms of service of websites; the monitoring of traffic to web pages, so as to identify any abnormal flows of incoming and outgoing data; the implementation of specific measures against bots using, among others, the technological solutions made available by the same companies responsible for web scraping (e.g.: intervening on the robots.txt file).
These measures are not mandatory and data controllers shall assess, based on the principle of accountability, whether to implement them to prevent or mitigate, in a selective manner, the effects of web scraping, considering a number of elements such as the latest technology developments and the costs of implementation, in particular for SMEs.
While waiting to decide – following the outcome of a number of investigations already under way, including the one against OpenAI - on the lawfulness of web scraping of personal data performed on the basis of legitimate interest, the Garante deemed it necessary to provide data controllers who publish personal data online with initial guidance on the need to adopt appropriate security measures to prevent or, at least, hinder web scraping.
In the guidance document, the Garante suggests a number of concrete measures to be adopted: the creation of reserved areas, accessible only upon registration, so as to remove data from public availability; the inclusion of anti-scraping clauses in the terms of service of websites; the monitoring of traffic to web pages, so as to identify any abnormal flows of incoming and outgoing data; the implementation of specific measures against bots using, among others, the technological solutions made available by the same companies responsible for web scraping (e.g.: intervening on the robots.txt file).
These measures are not mandatory and data controllers shall assess, based on the principle of accountability, whether to implement them to prevent or mitigate, in a selective manner, the effects of web scraping, considering a number of elements such as the latest technology developments and the costs of implementation, in particular for SMEs.
