On April 30, 2020, the French Data Protection Authority (the “CNIL”) published guidance on the extraction of web users’ personal data from online public spaces by web scraping tools and re-use of such data for direct marketing (the “Guidance”). The Guidance was issued following inspections carried out by the CNIL in 2019.

Background

The CNIL regularly receives complaints about business practices consisting of extracting personal data from web pages in order to send direct marketing communications. The complaints typically concern companies that collect telephone numbers of individuals who appear on ads displayed on consumer-to-consumer websites or in online directories. This information is then used to send direct marketing communications to those individuals, who may have objected to receiving such communications in the past. Those involved include:

• Companies that create databases by consulting real estate ads and extracting the data of the individuals who published those ads. The databases are then sold to real estate agencies or other companies who send direct marketing communications to those individuals; and
• Companies that collect, for their own purposes, all the personal data from a given geographic area in online directories and then use the data to send their own direct marketing communications (e.g., an insurance company to sell insurance products).

The CNIL carried out several inspections in 2019 to determine whether companies comply with the EU General Data Protection Regulation (“GDPR”) and the French Data Protection Act. The CNIL’s inspections revealed that a number of companies use tools such as web scraping (or data extraction) software to automatically collect web users’ data from online public spaces. The inspections further revealed several violations of the GDPR and the French Data Protection Act, such as insufficient information being provided to contacted individuals regarding the source of their data, and lack of consent for the sending of electronic direct marketing communications (e.g., emails or automated calls). The CNIL therefore decided to remind data controllers and their service providers of the best practices in this area.

Compliance with Basic Data Protection Principles

The Guidance stresses that individuals’ contact details published in online public spaces are still personal data, even if the data is publicly available. As such, companies may not freely re-use the data, and may not further process it without the individuals’ knowledge. Companies must comply with basic data protection principles. This includes:

• Obtaining individuals’ freely given, specific, informed and unambiguous consent. When individuals share their personal data with one data controller, it is not reasonably expected that they will receive direct marketing from another company – another company may re-use their data for such purposes only with the individuals’ consent. Similarly, when a company re-uses publicly available online data of individuals in order to send direct marketing communications about its products and services by e-mail or through automated calling systems, the company must obtain the individuals’ consent before sending.
• Respecting the individual’s right to object as provided for in the GDPR. When a company sends direct marketing communications by non-electronic means (e.g., by live phone calls), the web scraping tool must not collect data of individuals included in opt-out lists from telecom operators or in France’s BLOCTEL opt-out list.

Key Steps Before Using Web Scraping Tools

The Guidance also recommends taking the following steps before using web scraping tools:

• Verifying the nature and origin of the data that will be scraped: the Guidance notes that some tools extract information from websites whose terms of use prohibit the extraction and re-use of data for marketing purposes. In this case, the practice is clearly unlawful.
• Minimizing data collection: companies using web scraping tools must be particularly cautious and avoid collecting irrelevant and excessive information, particularly if that information is sensitive (e.g., health information or information relating to the religion or sexual orientation of individuals).
• Providing notice to individuals: in addition, companies using web scraping tools must provide notice to individuals whose data has been extracted for direct marketing, at the latest at the time of the first communication with those individuals. The notice must contain all the information listed in Article 14 of the GDPR, including the source of the data.
• Managing the contractual relationship with the web scraping service provider: when companies engage a web scraping service provider, they must ensure that the above measures will be complied with by the service provider. In addition, companies must ensure that they have a proper data processing agreement in place with that service provider in compliance with Article 28 of the GDPR.
• Carrying out a Data Protection Impact Assessment (“DPIA”) if necessary: in some cases, a DPIA must be carried out before implementing the data processing. Even if a DPIA is not required, the Guidance emphasizes that it is best practice to carry one out.

The Guidance also stresses that the CNIL will remain vigilant in respect of these practices to ensure that individuals’ data protection rights are guaranteed.