Generative AI and web scraping: the indications from the Italian Data Protection Authority

​

The Italian Data Protection Authority (Garante Italiano per la Protezione dei Dati Personali) has recently issued its information note on the web scraping aimed at the training of Generative Artificial Intelligence models. 

Web scraping involves the extensive and indiscriminate collection of data, including personal data, using various techniques such as web crawling¹​.This activity is paired with the storage and preservation of data collected by web robots (bots) for subsequent targeted analysis, processing, and usage.

In recent years, this technique has gained prominence due to th​e evolution and optimization of Generative AI systems, which are trained on data scraped from the web. Regarding the personal data involved in this activity, many companies justify its processing based on legitimate interest as a legal basis.

While the Italian Data Protection Authority (Garante) continues to investigate this matter, particularly concerning OpenAI and the legal bases for model training, some platforms are already leveraging this legal basis. Therefore, the Authority has issued an information note in the measure of 20 May 2024 providing guidance for data controllers who make personal data publicly available, thereby exposing it to potential web scraping by third parties.

The first suggestion from the Authority is the creation of account areas, accessible only via prior registration, making data unavailable to the public. This measure should, nonetheless, infringe the minimization principle (art. 5 GDPR): the data controllers (platforms, websites, companies, etc.) should not exceed the necessity of the processing of personal data. (e.g. with reference to those cases requiring registration before the finalization of an online purchase: such measures has been considered unlawful by some Authorities​^2​). 

The second possible measure to be adopted could be the integration of the Terms of Conditions of the websites or online platforms, with specific clauses prohibiting the use of web scraping. This measure could act as an ex-post enforcement, allowing the data controllers to object the contractual breach in case the clause of prohibition would be infringed. 

Third recommendation is the monitoring of the HTTP requests received by a website or online platform, allowing them to identify anomalies within inbound and outbound data flows. 

A fourth measure is the action on bots, using: 

This kind of measures recommended by the Authority is not mandatory, and their adoption should be assessed on a case-by-case basis, also considering the availability of technologies, budget and resources of the companies. Also, such measures should not infringe the principle of minimization, thus the data controller should always properly assess the necessity of personal data processing compared to the purpose.