PCPD joins international efforts to scrap scraping

In this legal update, we report that the Privacy Commissioner for Personal Data in Hong Kong (“PCPD”) has joined with eleven other privacy authorities across the globe to issue a joint statement on 24 August 2023 calling for awareness and action from social media platforms in respect of illegal data scraping practices.

Data scraping is the extraction of data – including personal data – from the web through automated processes. The individual data subject is unlikely to have knowledge of nor consent to this action. This creates the opportunity for exploitation, such as the sale of the data, and the use of the data in cyberattacks, identity fraud or unwanted direct marketing and spam messages.

The joint statement sets out global expectations and principles, noting that:

• Personal data that is publicly accessible is still subject to data protection and privacy laws.

• Social media companies and the operators of websites that host publicly accessible personal data have obligations under data protection and privacy laws to protect personal information on their platforms from unlawful data scraping.

• Mass data scraping incidents that harvest personal information can constitute reportable data breaches in many jurisdictions.

Under Hong Kong law, data users who make personal data available in the public domain may specify the circumstances under which personal data may be accessed and used. It may limit the kind of persons making access and the purposes of use of the data. A person who collects personal data from the public domain regardless of these stipulations and restrictions will contravene applicable data protection principles. Also, the fact that a data subject’s personal data can be obtained from the public domain does not mean that the data subject has given consent for all uses.

The joint statement also incorporates recommendations for social media platforms and websites to adopt multi-layered technical and procedural controls, including designating teams responsible for implementing privacy-related controls against data scraping.

The joint statement was sent to the major operators of social media platforms including Facebook, Instagram, LinkedIn and YouTube, and those companies were invited to deliver feedback on their expected compliance with the expectations and principles in the statement by the end of September 2023. We can expect this to be a topic of interest in Hong Kong in future.

The full statement can be found at this link, and the media statement of the PCPD is on this link.

Pádraig Walsh and Phoebe Chan

If you would like to discuss any of the matters raised in this article, please contact:

Pádraig Walsh

Partner | Email

Disclaimer: This publication is general in nature and is not intended to constitute legal advice. You should seek professional advice before taking any action in relation to the matters dealt with in this publication.