Hong Kong’s privacy watchdog joins hands with international counterparts to combat data scraping

Hong Kong’s privacy watchdog and eleven other privacy protection authorities around the globe on Friday issued a joint statement to remind social media platforms and websites to protect personal data from unlawful data scraping. 

The other authorities are from Argentina, Australia, Canada, Colombia, Jersey, Mexico, Morocco, New Zealand, Norway, Switzerland and the UK. 

Data scraping generally involves the extraction of data, including personal data, from the web by automated processes, and it raises significant privacy concerns, the Office of the Privacy Commissioner for Personal Data (PCPD) said. 

It can result in personal data being sold on the dark web without the knowledge and consent of the data subject, leading to the exploitation of personal data for targeted cyberattacks, identity fraud, and unwanted direct marketing or spam messages. 

The watchdogs point out in the joint statement that personal information that is publicly accessible is still subject to data protection and privacy laws in most jurisdictions. 

They also say social media companies and operators of websites that host publicly accessible personal data have obligations under data protection and privacy laws to protect personal information on their platforms from unlawful data scraping. 

They warn that mass data scraping incidents that harvest personal information can also constitute reportable data breaches in many jurisdictions. 

The watchdogs suggest these social media platforms and websites implement multi-layered technical and procedural controls to mitigate the privacy risks of data scraping. 

They advise these platforms to designate a team and specific roles to identify and implement controls to protect against data scraping activities and to take steps to review automated scraping programs and data scraping and take action to stop such activities. 

The PCPD said the joint statement was sent to companies running major social media platforms, including YouTube, Instagram, Facebook, Threads, and LinkedIn. 

The PCPD said they look forward to receiving feedback from the companies within one month about how they currently comply or intend to comply, with the expectations and principles detailed in the joint statement.