What is data scraping?
Data scraping refers to the practice of automatically collecting, or ‘scraping’, publicly available data from online sources, for example, from websites like LinkedIn. Data scrapers (ie those involved in data scraping) use software to do this. Data scraping is usually invisible to everyone besides the scraper.
The collected data can be used for many purposes, including contact scraping of email addresses to compile a mailing list, web scraping of the underlying code, competitor monitoring by collecting competitors’ price information, or reputation monitoring of comments made on social media platforms or review sites. It is also often used for screen scraping, which allows the scraper to emulate a human end-user to extract publicly available data from websites on a large scale.
What is data mining?
Data mining refers to the practice of analysing batches of raw data (ie data that has been collected but not processed in any other way) to identify patterns and insights and extract useful information. Data miners (ie those involved in data mining), like data scrapers, use software to do this.
Data mining is often used to predict trends and to create (and test) models. Many businesses rely on data mining to learn more about their customer base (eg what their purchase behaviour is, what their interests are or what they may wish to buy), to detect and prevent fraud, and to create spam filters.
Are data scraping and data mining legal?
Neither data scraping nor data mining are in themselves illegal. However, there are certain instances where such conduct may become illegal depending on how the data is scraped/mined, why the data is scraped/mined and how it is used.
The most common claims that can be brought against data scrapers and data miners are breach of contract claims and database right infringement claims (a type of intellectual property (IP) infringement claim). Depending on the precise circumstances, it is possible for data scraping and mining to also infringe copyrights, contravene the Computer Misuse Act 1990, and breach data protection legislation.
Breaches of contract
To have a justified breach of contract claim, the owner of the website in question has to show that its terms and conditions of use are enforceable and have been breached. It is now very common for Website terms and conditions to expressly prohibit data scraping (or equivalent activities) and data mining.
While there is no clear precedent stating whether website terms form binding contracts in the UK, Ryanair Ltd v PR Aviation BV, a 2015 case brought to the European Court of Justice, held that website operators can prohibit ‘screen scraping’ of unprotected data via their website terms and conditions. This means that website operators can set contractual restrictions that prohibit other businesses from ‘scraping’ information from their sites if they cannot wholly rely on IP rights protecting against unauthorised use of that data.
IP and database right infringements
A licence is typically needed to scrape or mine data from databases. If a database is scraped/mined without a valid licence (or if the licence held doesn’t allow the type of conduct occurring), this may amount to database right infringement. Whether an infringement took place depends on the specifics of the case, including:
-
the type and volume of data that is being extracted/mined
-
the frequency with which the data is being extracted/mined
-
the level of investment that was required to develop the database from which the data is being extracted/mined
As data being scraped/mined may comprise copyrighted work, scraping/mining may also amount to a copyright infringement for which a claim can be brought by the copyright owner. Note that certain types of data mining may be permissible under the text and data mining for non-commercial research exception to copyright, included in the Copyright, Designs and Patents Act 1988. This exception permits the data mining of copyrighted work so long as the data miner has lawful access to the data source and is mining the data for non-commercial research. For more information, read Exceptions to copyright.
Alternatively, if any of the data is considered trade secrets, this can provide the scraped/mined website with another course of action. The Trade Secrets (Enforcement, etc.) Regulations 2018 make revealing or using a trade secret unlawful where such constitutes a breach of confidence regarding confidential information.
For more information on these types of IP protection, read Copyright, Protecting confidential information and trade secrets, and the government’s guidance on database rights.
Offences under the Computer Misuse Act 1990
Under the Computer Misuse Act 1990, it is a criminal offence to access a computer program or data without authorisation. This may apply to data scrapers and miners if the website owner prohibits the type of access made by them (eg in the website’s terms of use). This has, however, not yet been tested in practice.
Data protection breaches
Data scraping or mining that involves personal data (ie information that relates to private individuals who can be personally identified from that data, such as names, addresses and genetic information) must comply with The UK General Data Protection Regulation (GDPR) and the Data Protection Act 2018. Regardless of whether such personal data is publicly available, it is always subject to data protection legislation and failure to comply with these laws can result in steep fines.
If a business is carrying out large-scale processing (eg collecting and analysing) of personal data within data scraping and data mining, it should consider whether carrying out a Data protection impact assessment (DPIA) is necessary. For more information, read Data protection impact assessments.
For more information on data protection in general, read Data protection, Processing personal data, Complying with the GDPR and Data protection principles.
Data scraping and data mining compliantly
All in all, there is no simple answer as to the legality of data scraping and mining, as this depends on the exact circumstances of each case. If you are interested in data scraping or mining, you should always follow the terms and conditions of each of the websites you use, to be on the safe side. If they state that they do not allow scraping or mining, you should comply with this. Alternatively, you may be able to get permission to perform your business activities by contacting the website operators. In all circumstances, you must make sure to avoid misuse of data in relation to data mining and scraping.
Ask a lawyer if you have any questions or concerns about data scraping or data mining.
