EPIC urges EDPB to tighten draft guidelines on web scraping for AI training

Ce qui s’est passé

EPIC submitted comments to the European Data Protection Board on its draft Guidelines addressing web scraping for generative AI. The organization argues that the practice is largely illegal under the GDPR, citing legitimate interest as the only possible legal basis and highlighting deficiencies in transparency and data minimisation. EPIC recommends a public registry for scraped data use and a default prohibition unless explicit permission is indicated.

Pourquoi c’est important pour la confiance et la conformité

• Its status is proposed. It is not law yet. Track it, but do not treat it as an obligation.
• The comments highlight significant privacy risks of web‑scraped data for AI, urging stricter guidance to protect individuals under the GDPR.
• It relates to GDPR. The regulations library explains what that law requires.

Who is affected

Recommended actions

1. Check that privacy notices describe the practices this addresses.
2. Confirm access, correction, deletion and opt-out requests are handled within the required time.
3. Revisit retention schedules and data minimisation for the data involved.
4. Inventory AI or automated decision systems in scope and their assessments.