Tue 12th Sep

Data scraping for online businesses

Article provided by our partners at Russell-Cooke

Answering your pressing questions on data scraping, the latest legislation, and how to protect your business from unlawful data scraping

What is data scraping?

“Data scraping” generally involves the automated extraction and re-use of data from the web – often relating to personal information that is “publicly available” on social media websites or other online sources. Organisations may use computer programmes such as “spiders” or “bots” for such purposes.

However, data scraping can be used for illegitimate means. From cases reported to the DPAs over recent years, they have identified a number of data privacy concerns arising from use of data scraping technologies (particularly those that have the capacity to collect vast amounts of personal data).

These include exploiting scraped personal information for targeted cyberattacks, identity fraud, profiling and surveillance, unauthorised political or intelligence gathering and unwanted direct marketing or spam. In such cases, the individuals concerned were unaware that their data was scraped from their accounts/profiles on social media (or other) websites, which can undermine their trust in the organisations that run these sites.

Any business which hosts data online is at risk of third parties scraping their data.

What is the latest guidance and what should I be doing?

In late August, 12 data protection authorities based around the world (theDPAs) – including the UK’s Information Commissioner’s Office – issued a joint statement that advises social media companies and website operators to implement “multi-layered and procedural controls” to prevent unlawful data scraping and to encourage compliance with applicable laws on protecting personal data.

To tackle unlawful scraping, the data protection authorities have recommended that website operators apply a “combination” of technical and procedural controls that is “proportionate to the sensitivity of the information” that they hold.

For example, businesses who host data at risk of scraping may want to consider:

Setting up a team or specific roles within their organisations to protect against, monitor for, and respond to scraping activities
Identify data scraping activity (e.g. bots), such as by using CAPTCHAS, and blocking the IP address where such activity is detected. A CAPTCHA is a Completely Automated Public Turing test that tells computers apart from humans – a common example is where a user is required to look at a set of pictures and identify the ones which contain a specific object
Limiting access per hour or day by one account or other account profiles, or from where unusual activity is otherwise detected
Making use of legal actions such as having terms and conditions that require consent before data can be scraped, or “cease and desist” letters to enforce deletion of scraped information (and confirmation of the same)
increasing user awareness and understanding of the privacy settings they can activate when visiting/using their websites

More broadly, data scraping techniques (like other technologies) are dynamic and evolving – businesses must therefore remain vigilant to new opportunities where unlawful data scraping can compromise the privacy rights of individual users.

While these measures seek to prevent unlawful data scraping, it will likely also have implications on businesses that use scraping for legitimate, commercial purposes. For example, a business that carries out research & analysis may use scraped data to identify trends/behaviours among individual users.

In summary, there are various legal requirements and restrictions which businesses must bear in mind in the context of data scraping.