Italy - Web Scraping Guidance (329/2024)

Overview

The Garante's Provvedimento n.329 of 20 May 2024, published in the Gazzetta Ufficiale on 7 June 2024, issues a "Nota informativa" concerning large-scale web scraping that collects personal data for the training of generative artificial intelligence (AI) systems. The note is addressed primarily to the managers of websites and online platforms (both public and private) that act as data controllers for content published on their services and therefore have responsibilities under the EU General Data Protection Regulation (GDPR). The document explains the phenomenon—described as mass, indiscriminate harvesting of data via automated bots for later storage and training of AI models—and presents a non-exhaustive set of possible countermeasures that controllers might adopt to protect the personal data they publish. The Authority stresses that the guidance does not amount to a blanket ban on scraping nor does it adjudicate the lawfulness of scraping activities per se; rather, it provides practical recommendations to balance openness and reuse obligations with the need to protect personal data. Full text and official publication references can be consulted at the official pages of the Garante and the Gazzetta Ufficiale: Garante - Provvedimento n.329 (doc web n.10020316) and Gazzetta Ufficiale - Provvedimento n.329 (24A02916).

Definitions

For the purposes of the note, "web scraping" is described as the activity of automated collection—typically via bots and crawlers—of large quantities of information available on the web, with a focus on repetitive, mass harvesting intended to compile datasets for subsequent analysis or algorithmic training. "Generative AI" (IAG in Italian) refers to models and systems trained to generate new content (text, images, code, audio, etc.) using large-scale datasets. "Data controller" denotes an entity that determines the purposes and means of processing personal data published on websites or platforms. The note distinguishes direct scraping (collector is also developer), indirect scraping (datasets produced by third parties), and hybrid approaches. It also highlights categories of special concern (e.g., sensitive data, minors' data, and data subject to specific legal regimes such as copyright or public access laws).

Governance and Institutional Framework

The measure is grounded in the Garante's supervisory and awareness-raising powers as set out in Article 57(1)(b) of the GDPR and references national implementing legislation (d.lgs. 196/2003 as amended). The Authority frames the note within its broader inquiry into web scraping (an earlier initiative beginning with an investigative notice dated 21 December 2023) and builds on prior enforcement activity concerning scraping and unlawful repurposing of personal data (for example, previous decisions and public documents concerning the activities of third-party actors such as Clearview). The document clarifies the roles: website/platform operators who are data controllers should assess and possibly implement technical, organisational and contractual measures; the Garante retains competence to investigate and take enforcement action where unlawful processing is suspected. The institutional texts referred to include the GDPR itself (Regulation (EU) 2016/679) and the official Garante publication pages: Garante - Provvedimento n.329.

Key Focus Areas

The note structures its guidance around a set of focus areas relevant for controllers facing the risk of scraping for AI training: (1) access regimes and publicity: controllers should review whether published data must remain public or whether access restrictions are appropriate (e.g., registration-protected zones); (2) contractual and terms-of-use strategies: updating terms of service and API contracts to expressly prohibit mass extraction and re-use for AI training where incompatible with legal bases; (3) technical anti-scraping measures: implementation of robots.txt, rate limiting, bot detection, CAPTCHAs, IP blacklisting/whitelisting, and other measures that reduce automated harvesting; (4) data governance and minimization: revising publication practices to avoid unnecessary exposure of personal data and ensuring principle of minimization; (5) legal and enforcement responses: preparing to deploy cease-and-desist notices and, where appropriate, report violations to authorities; (6) balancing public-interest transparency obligations with privacy protection, especially for public-sector bodies bound by openness and re-use duties. The note emphasizes a case-by-case analysis and suggests that small entities weigh costs and feasibility when adopting measures. It reiterates that protective measures must not contravene other legal duties (e.g., transparency or reuse obligations for public administrations).

Implementation Framework

The Garante recommends a layered, risk-based approach to implementation. Controllers should begin with a factual mapping: identify categories of personal data published, legal bases for publication, expected reuse and access rights, and the volume and sensitivity of data exposed. Based on that mapping, controllers should assess appropriate measures across technical, organisational and contractual dimensions. Technical steps include adjusting robots.txt and meta tags, deploying real-time bot detection and throttling, shielding endpoints behind authenticated APIs, segmenting or gating access to particularly sensitive sections, and monitoring unusual access patterns. Organisational measures include updated internal policies, staff training, incident response plans and documentation for decisions (records of processing, DPIAs where necessary). Contractual measures include revising terms of use, adding explicit prohibitions on mass harvesting and AI training, and appropriate licensing for any allowed data reuse. The Garante suggests that public authorities must carefully reconcile these measures with public-sector transparency and open-data obligations, possibly applying differentiated regimes per dataset or content type. For more detail see the official note: Garante - Nota informativa.

Monitoring and Evaluation

The note advises continuous monitoring of traffic and access patterns, logging of automated access attempts, and periodic reviews of access control effectiveness. Controllers are encouraged to keep traceable records of measures adopted and risk assessments carried out, and to perform periodic Data Protection Impact Assessments (DPIAs) when scraping risks to data subjects are high (e.g., large-scale processing of special categories of data or children’s data). Metrics for evaluation include reduction in automated harvesting incidents, number of blocked IPs/requests, and compliance audits of contractual clauses. The Authority notes that such monitoring and documentation will facilitate both internal governance and any future supervisory inquiries.

Penalties, Liability, and Appeals

While the note itself is informational and not sancionatory in form, it explicitly recalls that unlawful processing of personal data remains subject to the enforcement regime of the GDPR and national law. Potential enforcement measures include orders to cease unlawful processing, corrective measures and administrative fines under Article 83 GDPR (including fines up to €20 million or 4% of global annual turnover, whichever is higher) where applicable. Civil liability to data subjects (compensation) may arise under Article 82 GDPR. The Garante retains the power to investigate and apply remedies; controllers should therefore document their risk assessments and the proportionality of any protective actions. For legal background on enforcement powers see the GDPR text: Regulation (EU) 2016/679 and the Garante's official page: Provvedimento n.329.

Relationship to Other Instruments

The note situates itself relative to other legal and policy frameworks: the GDPR (privacy/data protection), national implementing legislation (d.lgs. 196/2003, as amended), public-sector transparency/open-data rules, and intellectual property law (copyright may limit redistribution of certain content). It also references prior Garante documents addressing scraping incidents and breaches (for instance, earlier case material concerning Clearview and other scraping-related decisions available in the Garante's document archive). The note complements EU-level policy debates and does not prejudge future legislation specific to AI training datasets (such as sectoral or EU AI Act provisions), but it highlights areas where harmonisation between data protection obligations and other legal regimes is necessary.

International Alignment

The Garante references international materials and decisions from other data protection authorities when framing its guidance. The note acknowledges similar concerns raised in other jurisdictions and cross-border enforcement dynamics where data controllers, processors or scraping actors operate transnationally. It invites controllers to consider international decisions and case studies (for instance, redacted decisions or supervisory authority guidance from other EU data protection authorities) when formulating measures. See the Garante reference list and links for cited international material: Garante - references.

Implementation Timeline

Sources and References