FCRA Could Be Template for US Web Scraping Law, Professors Say
The U.S. Fair Credit Reporting Act (FCRA) takes an EU-like approach to data scraping and could serve as a precedent for new laws that allow scraping in certain situations while banning it in others, said law professors Daniel Solove of George Washington University and Woodrow Hartzog of Boston University during a webinar Tuesday where they discussed their paper on the clash between scraping and privacy (see 2510160018).
Sign up for a free preview to unlock the rest of this article
Privacy Daily provides accurate coverage of newsworthy developments in data protection legislation, regulation, litigation, and enforcement for privacy professionals responsible for ensuring effective organizational data privacy compliance.
Solove and Hartzog argued that scraping conflicts with privacy and that some reconciliation between scraping and foundational privacy law must be found.
Under FCRA, credit reporting agencies are permitted to collect data from a range of sources and use it for credit reports, Solove said. It covers specific uses, such as credit and background reports. Much of the information is in the public realm, but FCRA recognizes that some uses of publicly available data are harmful and require regulation, he said.
In the U.S., Solove noted, something is allowed unless law prohibits it, while in the EU, an activity isn't permissible until authorized by law. Under the GDPR, one of the legal bases for processing personal data is the public interest exception, he said. There must be a justification for allowing scraping in the public interest. In addition, once data is scraped, it doesn't lose all its privacy protections, so some protections are feasible.
It sounds extreme to switch the default setting in the U.S. from legal if not prohibited, but scraping is a unique activity that has for too long been lumped in with other activities, and this is an opportunity to craft a careful expansion of U.S. law to incorporate legal basis requirements, said Hartzog. Solove said that's where FCRA could serve as a precedent.
The problem of scraping is getting worse because the U.S. is so "needy" for data to help AI companies prop up its economy, said Solove. It's like the early days of the internet, and "I think we'll see a reckoning."
While there is case law on scraping, it tends to focus on computer fraud and abuse, trespass and other property concepts rather than on personal data, Solove said. After 25-30 years of litigation on scraping, nothing much has been resolved, he added.
In their paper, the academics examined what privacy law says about the practice. Some laws say scraping is illegal, while others say it's permissible because the information is publicly available, Solove said. Still others hold that the publicly available exception to banning scraping isn't as broad as tech companies say it is.
Under the GDPR, there's no publicly available exception for scraping, Solove noted. The EU started to enforce it against scraping, but no one wants to state that scraping doesn't fit under the GDPR, he said. "No one wants to say no to AI" and be accused of killing innovation.
There are some U.S. state privacy laws and other measures that have a narrower publicly available information exception, but the situation is murky, Solove said. No one has had the guts to say that scraping violates privacy law because it's politically difficult, he added.
The paper concludes that scraping is essentially "a privacy nightmare" that can't be squared with data-protection principles, said Solove. Nevertheless, it should be allowed under certain conditions, he argued.
Scraping plays a vital role in activities that are in the public interest, Hartzog added. The paper proposes a conceptual reframing of the issue in which scraping is viewed as surveillance and protection against scraping as a stewardship obligation akin to data security requirements, he said. Also, the paper suggests that lawmakers consider a specific rule that starts with a default ban but justifies scraping when it's in the public interest.