On 30 May 2024, the Italian Data Protection Authority (Garante) released guidance to help public and private data controllers protect personal data published online from web scraping. Recognising that the collecting entities have their own obligation to ensure lawfulness under GDPR, this guideline is for the other side – the website operators that undergo the scraping. Web scraping is an indiscriminate collection of personal data by third parties, often for the purpose of training generative AI models – and ongoing investigations, including one against OpenAI, will determine the lawfulness of such practices based on legitimate interest.
Recommendations
- Reserved Areas: Garante advises creating restricted access areas, requiring registration to reduce public data availability.
- Anti-Scraping Clauses: Including specific clauses in terms of service can provide legal grounds against violators, deterring unauthorized data collection.
- Traffic Monitoring: Monitoring web traffic for abnormal data flows can help identify and mitigate web scraping activities.
- Bot Mitigation: Implementing measures against bots, such as CAPTCHA checks, modifying HTML markup, embedding data in images, and using robots.txt files, can make data scraping more challenging.
These measures are suggestions and not mandatory. Website data controllers are responsible for deciding which measures to implement, considering factors like technology developments and implementation costs, particularly for small and medium-sized enterprises.
Garante emphasizes that these measures cannot completely prevent web scraping but are essential for reducing unauthorized data use. Website operators must evaluate and implement appropriate measures to protect personal data from scraping.
👉 Find the press release and guidance in Italian here.
👉 Get an automated translation into English here.
♻️ Share this if you found it useful.
đź’Ą Follow me on Linkedin for updates and discussions on privacy education.
đź“Ť Subscribe to my newsletter for weekly updates and insights – subscribers get integrated view of the week and more information than on the blog.
