<\/p>\n
A joint statement signed by regulators at a dozen international privacy watchdogs, including the U.K.\u2019s ICO, Canada\u2019s OPC and Hong Kong\u2019s OPCPD, has urged mainstream social media platforms to protect users\u2019 public posts from scraping \u2014 warning they face a legal responsibility to do so in most markets.<\/p>\n
\u201cIn most jurisdictions, personal information that is \u2018publicly available\u2019, \u2018publicly accessible\u2019 or \u2018of a public nature\u2019 on the internet, is subject to data protection and privacy laws,\u201d they write. \u201cIndividuals and companies that scrape such personal information are therefore responsible for ensuring that they comply with these and other applicable laws. However, social media companies and the operators of other websites that host publicly accessible personal information (SMCs and other websites) also have data protection obligations with respect to third-party scraping from their sites. These obligations will generally apply to personal information whether that information is publicly accessible or not. Mass data scraping of personal information can constitute a reportable data breach in many jurisdictions.\u201d<\/p>\n
The timing of the statement, which was also signed by privacy regulators in Australia, Switzerland, Norway, New Zealand, Colombia, Jersey, Morocco, Argentina and Mexico \u2014 who are all members of the Global Privacy Assembly\u2019s international enforcement cooperation working group \u2014 coincides with the ongoing hype around generative AI models which typically require large amounts of data for training and could encourage more entities to scrape the Internet in a bid to acquire data-sets jump on the generative AI bandwagon.<\/p>\n
High profile examples of such systems, such as OpenAI\u2019s large language model ChatGPT, have relied (at least in part) upon data posted online for training their systems \u2014 and a class action lawsuit filed against the U.S. company in June, which CNN Business reported on, alleges it\u00a0secretly scraped \u201cmassive amounts of personal data from the internet\u201d.<\/p>\n
Among the privacy risks the regulators highlight is the use of data scraping for targeted cyberattacks such as social engineering and phishing; identity fraud; and for the monitoring, profiling and surveilling of individuals, such as using data to populate facial recognition databases and provide unauthorised access to authorities \u2014 a clear swipe at Clearview AI, which has faced a number of enforcements from international regulators (including several across the EU) over its use of scraped data to power a facial recognition ID tool which it sold to law enforcement and other users.<\/p>\n
They also warn scraped data can be used for unauthorised political or intelligence gathering purposes \u2014 including by foreign governments or intelligence agencies. And be used to pump out unwanted direct marketing or spam.<\/p>\n
They don\u2019t directly cite the training of AI models as one of these \u201ckey\u201d privacy risks but generative AI tools which have been trained on people\u2019s data without their knowledge or consent could be repurposed for a number of the malicious use cases they cite, including to impersonate people for targeted cyberattacks, identity fraud, or to monitor\/surveil individuals.<\/p>\n
As well as the statement being made public, the regulators note that a copy has been sent directly to YouTube\u2019s parent company, Alphabet; TikTok\u2019s parent ByteDance; Meta (owner of Instagram, Facebook and Threads); Microsoft (LinkedIn); Sina Corp (Weibo); and X (aka, the platform previously known as Twitter) \u2014 so mainstream global social media platforms are clearly front-and-center as the international watchdogs consider the privacy risks posed by data scraping.<\/p>\n
Some platforms have of course already had major data scandals linked to data scraping \u2014 such as the 2018 Cambridge Analytica data misuse scandal which hit Facebook after a developer on its platform was able to extract data on millions of users without their knowledge or consent as a result of lax permissions the company applied; or the $275 million General Data Protection Regulation (GDPR) penalty Facebook was handed last year in relation to a data scraping incident that affected 530 million users as a result of insecure product design. (The latter incident is also subject to a lawsuit by an Irish digital rights group that\u2019s challenging the DPA\u2019s enforcement finding that there was no security breach.)<\/p>\n
While the regulators\u2019 joint statement contains a clear shot across the bows of mainstream social media site on the need to be proactive about protecting users\u2019 information from scraping, there is no commensurately clear warning accompanying the message that failure to act and protect people\u2019s data will result in enforcement action \u2014 which does risk diluting the statement\u2019s impact somewhat.<\/p>\n
Instead, the watchdogs urge platforms to \u201ccarefully consider the legality of different types of data scraping in the jurisdictions applicable to them and implement measures to protect against unlawful data scraping\u201d.<\/p>\n
\u201cTechniques for scraping and extracting value from publicly accessible data are constantly emerging and evolving. Data security is a dynamic responsibility and vigilance is paramount,\u201d they also write. \u201cAs no one safeguard will adequately protect against all potential privacy harms associated with data scraping, SMCs and other websites should implement multi-layered technical and procedural controls to mitigate the risks.\u201d<\/p>\n
Recommended measures to limit the risks of user data being scraped that are mentioned in the letter include having designated in-house team\/roles focused on data scraping risks; \u2018rate limiting\u2019 the number of visits per hour or day by one account to other account profiles\u00a0and limiting access if unusual activity is detected; and monitoring how quickly and aggressively a new account starts looking for other users and taking steps to respond to abnormal activity.<\/p>\n
They also suggest platforms take steps to detect scrapers by identifying patterns in bot activity \u2014 such as having systems to spot suspicious IP address activity.<\/p>\n
Taking steps to detect bots such as deploying CAPTCHAs and blocking IP address where data scraping activity is identified is another recommendation (albeit bots can solve CAPTCHAs\u00a0so that piece of advice is already looking outdated).<\/p>\n
Other recommended measures is for platforms to take appropriate legal action against scrapers, such as sending of \u2018cease and desist\u2019 letters; requiring the deletion of scraped information; obtaining confirmation of the deletion; and taking other legal action to enforce terms and conditions prohibiting data scraping.<\/p>\n
Platforms may also have a requirement to notify affected individuals and privacy regulators under existing data breach laws, the watchdogs warn.<\/p>\n
The social media giants who were sent a copy of the letter are being encouraged to respond with feedback within a month demonstrating how they will meet regulators\u2019 expectations.<\/p>\n
The letter does also include some advice for individuals to take steps to help protect themselves against the risks of scraping \u2014 including suggesting web users pay attention to platforms\u2019 privacy policies; think carefully about what they choose to share online; and make use of any settings that allow them to control the visibility of their posts.<\/p>\n
\u201cUltimately, we encourage individuals to think long term,\u201d they add. \u201cHow would a person feel years later, about the information that they share today? While SMCs and other websites may offer tools to delete or hide information, that same information can live forever on the web if it has been indexed or scraped, and onward shared.\u201d<\/p>\n
The letter also urges individuals who are concerned their data may have been scraped \u201cunlawfully, or improperly\u201d to contact the platform or website in question and if they do not get a satisfactory response it suggests they file a complaint with their relevant data protection authority.\u00a0So the regulators are encouraging users to be more vigilant about scraping which could, ultimately, lead to an uptick in investigations and enforcements in this area.<\/p>\n
The dozen international regulators signing the joint statement all hail from non-European Union markets. But, as noted above, EU data protection regulators are already active on data scraping risks through enforcements taken under the bloc\u2019s GDPR.<\/p>\n
They are also closely watching developments in generative AI services \u2014 so concerns raised in the letter look broadly aligned with issues already on the radar of the bloc\u2019s data protection authorities.<\/p>\n
Notably, Italy\u2019s privacy watchdog slapped ChatGPT with a local stop-processing order earlier this year \u2014 which led to a brief break in service while OpenAI rushed out with disclosures and controls. Google\u2019s Bard AI chatbot took longer to launch in the EU than in some other regions after its lead EU privacy regulator in Ireland raised similar concerns. But EU DPAs are simultaneously coordinating on how best to apply the local data protection rules to these novel AI chatbots, including vis-a-vis the crux issue of the lawfulness of the data processing used to train the models in light of the GDPR\u2019s framework. So decisions on the core legality of tools like ChatGPT remains pending in the EU.<\/p>\n
Earlier this year, France\u2019s DPA, the CNIL, also warned that protection against data scraping will be a key plank of an AI action plan it announced in May.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"
A joint statement signed by regulators at a dozen international privacy watchdogs, including the U.K.\u2019s ICO, Canada\u2019s OPC and Hong Kong\u2019s OPCPD, has urged mainstream social media platforms to protect users\u2019 public posts from scraping \u2014 warning they face a legal responsibility to do so in most markets. \u201cIn most jurisdictions, personal information that is […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[21],"tags":[],"class_list":["post-94510","post","type-post","status-publish","format-standard","category-technology"],"yoast_head":"\n