4 ms·

Thanks for the explanation. I understand that there are other legal reasons allowing storage and processing of (some) PII in (some) cases without given user con

Thanks for the explanation. I understand that there are other legal reasons allowing storage and processing of (some) PII in (some) cases without given user consent. But does that fit for "scraped PII"? I'd be very sceptic giving "public interest" or "legitimate interest" as a reason for storing and processing of PII in scraped data: "Public interest" (if not about some VIP or other public figure) mostly seems to be based on summarized data, so you would at least need to anonymize the data immediatly. The (identifiable) name or picture of a random scraped comment is hardly of "legitimate" or "public" interest. And vital interest or legal requirement for scraped data is hard to argue as well in most cases (I'd be even skeptical if used for law enforcement). Moreover, I have a hard time seeing a lot of cases where scraping PII by a company, organization or single person is required to perform a contract with the subject of the PII. Let's take a concrete example: Why would someone have the right to scrape all my Amazon reviews from the Amazon website under public or legitimate interest and store/process them with my name and my identifiable PII? I can see a public interest in scraping reviews and processing them without the PII, but I don't see a reason to do so without anonymization. So, I still see the comment holding: Scraped data falls under the GDPR and doesn't allow to store and process PII in most cases.

ratherbefuddled 7y ago
GDPR doesn't work like that, the means of obtaining the data does not relate to the legal basis you have for processing it. If you process personal data you need at least one legal basis, you decide what that is and you take on certain obligations. If you rely on "legitimate interest" GDPR requires you to consider the balance of your interest versus the subject's right to privacy. As long as you do so, record your determination and take reasonable steps to mitigate the privacy impact - such as allowing opt out, aging the data out over time etc - and you make good on your obligations it is unlikely an enforcement agency will find against you. It is a subjective decision however and there haven't been many GDPR cases handled by member states yet, so interpretations might change over time and all you can go on is guidance from regulators presently. I think a good example of where scraping and legitimate interest would be ok is if you are trying to sell a product appropriate to people with <job title>. You go to LinkedIn, pay for a facility that allows you to search for that job title, scrape that data and attempt to contact those people. There is some privacy impact but it is likely that people who make themselves available on a business networking site might reasonably expect to be contacted about things relevant to their job title. As long as they can opt out from your processing of their data and you don't keep it for longer than necessary and meet the other obligations you'll likely be fine (notwithstanding the ePrivacy directive which is a separate thing). An example where your grounds might be a lot more tenuous would be a recruitment agent scraping your name from a question on StackOverflow and guessing your email address to contact you about a job. In your Amazon review example, the processor would need to justify capturing your name. For most processing purposes (eg grouping the reviews by author) a hash would suffice.
- bkor 7y ago
  Could you add references to the sections of the GDPR which explain this? The various times I read the GDPR (as well as the local law) I didn't see your explanation in it. References would allow me to determine what I missed.

ratherbefuddled 7y ago

GDPR doesn't work like that, the means of obtaining the data does not relate to the legal basis you have for processing it. If you process personal data you need at least one legal basis, you decide what that is and you take on certain obligations. If you rely on "legitimate interest" GDPR requires you to consider the balance of your interest versus the subject's right to privacy. As long as you do so, record your determination and take reasonable steps to mitigate the privacy impact - such as allowing opt out, aging the data out over time etc - and you make good on your obligations it is unlikely an enforcement agency will find against you. It is a subjective decision however and there haven't been many GDPR cases handled by member states yet, so interpretations might change over time and all you can go on is guidance from regulators presently. I think a good example of where scraping and legitimate interest would be ok is if you are trying to sell a product appropriate to people with <job title>. You go to LinkedIn, pay for a facility that allows you to search for that job title, scrape that data and attempt to contact those people. There is some privacy impact but it is likely that people who make themselves available on a business networking site might reasonably expect to be contacted about things relevant to their job title. As long as they can opt out from your processing of their data and you don't keep it for longer than necessary and meet the other obligations you'll likely be fine (notwithstanding the ePrivacy directive which is a separate thing). An example where your grounds might be a lot more tenuous would be a recruitment agent scraping your name from a question on StackOverflow and guessing your email address to contact you about a job. In your Amazon review example, the processor would need to justify capturing your name. For most processing purposes (eg grouping the reviews by author) a hash would suffice.

bkor 7y ago
Could you add references to the sections of the GDPR which explain this? The various times I read the GDPR (as well as the local law) I didn't see your explanation in it. References would allow me to determine what I missed.