Bailiwick Data Protection Advisory - Data Scraping (2025-01-31)

Summary

This advisory from the Guernsey Office of the Data Protection Authority (ODPA) warns about a suspected data scraping incident in the Bailiwick, where an online business directory was scraped by a third party using automated tools and the harvested data was then offered for sale. It explains what data scraping is, notes the ODPA's role as a signatory to the Joint Global Data Scraping Statement, and sets out practical measures for businesses and individuals to reduce the risk.

• Businesses: Should implement low-cost safeguards such as rate limiting (throttling) and CAPTCHA on any website with business directories, user profiles, or other stored personal data, to prevent unlawful scraping.
• Individuals: Advised to read website privacy policies, limit the amount and sensitivity of personal information shared online, and review and manage privacy settings to reduce exposure to scraping-related risks such as identity fraud, harassment or discrimination.
• Reporting: Anyone concerned that their personal information or data rights have been compromised can contact the ODPA by email or phone.

The advisory reiterates the general legal expectation that businesses protect personal data with adequate safeguards at the source, warning that failure to do so can constitute a security breach and undermine consumer trust. It does not introduce new deadlines or formal filing requirements.

Key obligations

• Businesses must protect personal data with adequate safeguards at the source to prevent unlawful scraping.
• Businesses operating websites with business directories, user profiles, or other stored personal data are recommended to implement rate limiting/throttling and CAPTCHA tools.
• Individuals or businesses who suspect personal data or data rights have been compromised should contact the ODPA to report it.

Applies to

businesses in the Bailiwick operating websites with business directories or user profiles, data controllers storing personal data online, individuals whose personal data may be scraped