---
visibility: public
Language: English
tags:
  - Privacy
  - Artificial-Intelligence
  - Scraping
Publication Date: '2024-11-11'
Publication Type:
  - Blog Post
Ext. Link: >-
  https://www.cyberlawwatch.com/2024/11/11/navigating-the-intersection-of-data-scraping-and-artificial-intelligence-a-global-data-protection-authorities-take/
Source: K&L Gates Hub
Author(s):
  - '[[Claude-Étienne Armingaud]]'
  - '[[Anna Gaentzhirt]]'
NoteType: Publications
icon: "\U0001F4DA"
date: '2024-11-18'
title: >-
  Navigating the Intersection of Data Scraping and Artificial Intelligence - A
  Global Data Protection Authorities Take
created: '2024-11-18'
modified: '2024-11-18'
published: '2024-11-18'
---

In alignment with the ongoing concerns from several European data protection authorities publishing guidelines on data scrapping (i.e., the [**Dutch DPA**](https://www.autoriteitpersoonsgegevens.nl/uploads/2024-05/Handreiking%20scraping%20door%20particulieren%20en%20private%20organisaties.pdf), the [**Italian DPA**](https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10020334) and the [**UK Information Commissioner’s Office**](https://ico.org.uk/about-the-ico/ico-and-stakeholder-consultations/ico-consultation-series-on-generative-ai-and-data-protection/)), the Global Privacy Assembly (GPA)’s International Enforcement Cooperation Working Group (IEWG) recently published a [**Joint statement on data scraping and the protection of privacy**](https://www.privacy.org.nz/assets/IEWG-Data-Scraping-sub-group-draft-Joint-Statement-August-24-2023.pdf) (signed by the Canadian, British, Australian, Swiss, Norwegian, Moroccan, Mexican, and Jersey data protection authorities) to provide further input for businesses when considering data.

The statement emphasizes that:

- Even publicly accessible data is subject to privacy laws across most jurisdictions – meaning that scraping activities must comply with data protection regulations requiring a (i) lawful basis for data collection and, (ii) transparency with individuals, including obtaining [[consent]] where necessary.

- Collecting mass data can constitute a reportable [[personal data breach]] if it includes unauthorized access to [[personal data]].

- Relying on platform terms (e.g., Instagram) for data scraping does not automatically ensure compliance as (i) this contractually authorized use of scraped [[personal data]] is not automatically compliant with data protection and artificial intelligence (AI) laws, and (ii) it is difficult to determine whether scraped data is used solely for purposes allowed by the contract terms.

- When training AI models, it is critical to adhere not only to privacy regulations but also to emerging AI laws as ensuring AI model transparency and data [[processing]] limitations is now increasingly expected by privacy regulators.

The sensitivity of this topic underscores the close relationship between data protection and the ever-data-hungry artificial intelligence industry.

By Claude-Étienne Armingaud and Anna Gaentzhirt **- Originally published on K&L Gates** [Cyber Law Watch Blog](https://www.cyberlawwatch.com/2024/11/11/navigating-the-intersection-of-data-scraping-and-artificial-intelligence-a-global-data-protection-authorities-take/)