Data scraping for AI model training and data privacy: a comparative analysis of United States and European Union Data Privacy Laws

Abstract Artificial Intelligence (AI) has made data not only the choicest but also a very susceptible commodity. Even before the recent boom in AI, data was regarded as the new oil of the digital era. However, AI has amplified this due to its dependence on data for training AI models. In sourcing data for AI training, the internet is a rich resource with abundant data. Consequently, companies engage in massive data scraping to provide sufficient data for effective AI model training. Meanwhile, scraping often involves unauthorized access to information on websites or internet platforms, thereby raising legal concerns, including privacy-related issues. In this note, the authors explore the intersection between AI model training and data scraping using a doctrinal research method, further interrogating the lawfulness of scraping under extant data privacy laws in the United States (U.S.) and the European Union (EU). Findings show that in the U.S., scraping data for AI may be permissible as long as the scraped data is publicly accessible. On the other hand, data scraping of publicly available personal data violates the EU data protection laws, unless it satisfies the lawful basis requirements of Article 6 of the General Data Protection Regulation (GDPR). Whilst data scraping is not per se illegal under EU law, it is almost unjustifiable in light of the stringent requirements of Article 6 of the GDPR. Despite these stringent requirements, it is worth noting that in practice, the enforcement of the provisions of GDPR by the Data Protection Authority (DPA) has not been uniform across member states, considering the lenient approach in some jurisdictions. Regardless of the differences in the U.S. and EU jurisdictions, further analysis shows that data scraping generally undermines data privacy, as it operates against the very principles that underpin privacy protection. Underscoring the importance of data scraping to AI and innovation more broadly, the authors suggest reconciling data scraping with data privacy by rethinking and reforming extant privacy laws.