Certified Information Privacy Professional – United States (CIPP/US) — Question 193

A software company wants to use web scraping to collect personal data from professional networking websites in order to train an artificial intelligence program to evaluate job applications. The company has identified several actions for limiting their potential legal liability regarding affected data subjects and professional networking websites. Which of the following would be the least effective action for helping them do this?

Answer options

• A. Following the terms of use posted on professional networking websites that are scraped.
• B. Adding a notice to the company website’s terms of use disclosing the use of web scraping.
• C. Limiting the amount of the personally identifiable information they collect.
• D. Deidentifying the scraped data before selling it to any third parties.

Correct answer: B

Explanation

Option B is the least effective because merely adding a notice on the company's website does not mitigate legal risks associated with web scraping. In contrast, following the terms of use (A), limiting collected information (C), and deidentifying data (D) are all proactive measures that directly address compliance and privacy concerns.