Summary

  • The EDPB says a 2019 Court of Justice approach to search engines may be relevant to accidental, residual sensitive data in AI scraping only under four case-specific conditions.
  • The draft links that limited path to controls before collection, after collection, during model development and after deployment; it remains open for public comments until 30 October 2026.

A web page can be public and still contain personal data that an AI developer did not set out to collect. The difficult question is what happens when large-scale scraping finds material that reveals, for example, a person’s health, political views, ethnicity or sexual orientation. The European Data Protection Board (EDPB) has put that question into draft Guidelines 03/2026 on web scraping for generative-AI development. The draft is open for feedback through 30 October at 23:59 CET. It is guidance under consultation, not a final rule or a new exemption from the GDPR.

The EDPB starts from a clear distinction. If an organisation intentionally scrapes special-category personal data, Article 9(2) of the GDPR requires a specific derogation, in addition to a lawful basis under Article 6. The draft separately considers what to do when such data appear only as an unintended residue despite measures designed to prevent their collection. It says that some reasoning from the Court of Justice’s 2019 judgment in GC and Others v CNIL (Case C-136/17) may be relevant. That case concerned search-engine indexing and de-referencing, not the training of generative-AI models. The EDPB therefore does not treat it as a ready-made permission for model developers.

Instead, the draft calls for an individual assessment against four conditions. The processing must have relevant similarities to the search-engine activity considered by the Court; the sensitive data must be incidental and residual rather than deliberately processed; the controller must find it difficult or impossible to assess whether such data are present and prevent their collection; and the controller must use measures within its responsibilities, powers and capabilities to prevent dissemination. If those conditions do not fit the facts, the search-engine reasoning cannot supply a general route around Article 9.

The controls make “incidental” a claim that has to be supported across time. Before collection, the controller should set precise criteria, apply filters and exclude websites that structurally contain sensitive material; the draft gives sites mainly used by minors as an example. After collection, residual material should be deleted immediately or as soon as it is identified. A person’s request should prompt deletion when it provides a plausible indication that the material is prohibited Article 9 data. During development, the controller should test against extraction and privacy attacks and filter outputs that would reveal the data.

After deployment, the AI-system provider should monitor outputs continuously, tighten filters or restrict prompts when sensitive information appears, and consider model unlearning or an equally effective method if technology makes that possible.

The EDPB also expects the controller to show that the four conditions apply and that its controls are relevant and effective. Regular verification should cover both development and use; ineffective measures call for additional or different ones. That turns accountability into operational evidence: source exclusions, collection criteria, deletion records, model tests, output incidents and follow-up actions should tell one coherent story. A policy that simply calls data collection “incidental” cannot do that work.

This special-category analysis is separate from the draft’s guidance on legitimate interests. Public visibility does not itself equal consent to scrape data for a particular purpose, and the absence of a robots.txt rule is not GDPR consent. Website restrictions can still matter when a controller assesses people’s reasonable expectations in the legitimate-interest balancing test. Those signals affect the facts of the assessment; they do not replace the legal basis or Article 9 requirements.

The draft’s practical effect is to move the question upstream. If sensitive data are hard to detect only because collection is indiscriminate, that difficulty does not by itself establish that the case is residual. The proposed route asks whether the controller took feasible steps to prevent collection, could identify and remove what slipped through, and could stop the model from reproducing it. The public consultation is where organisations and individuals can challenge whether those expectations are clear enough before the EDPB finalises the text.

Sources

  1. EDPB Guidelines 03/2026 on web scraping for generative AI, §§ 67–77
  2. EDPB consultation page and deadline
  3. EDPB announcement on anonymisation and generative-AI web scraping
  4. Court of Justice, GC and Others v CNIL, Case C-136/17