NIST AI RMF, MeasureMEASURE 2.10

Scraping personal data from a public source excuses obtaining the data subject's consent, but does not excuse registering the resulting file or database, keeping the data accurate and secure, or observing the cross-border transfer restriction.

Do not collect personal information, including personal information scraped from a public website, unless it is reasonably necessary for one or more of the entity's functions or activities.

Do not use or disclose personal information collected for one purpose for another purpose, including model training, unless the individual consented or an Australian Privacy Principle 6.2 exception applies.

An app scraping personal data that was made public by someone other than the data subject, or without the subject's consent, does not benefit from the open-category ground and needs a separate lawful basis under Art. 9.6 before collecting or processing it.

Establish a lawful basis before collecting or processing personal data scraped from a public Barbadian website; public availability is not itself an exemption.

Do not scrape or otherwise process a biometric identifier unless the data subject consents or a specific statutory ground applies.

Apply PIPEDA's purpose-limitation and accountability obligations to personal information collected by crawling, the same as personal information collected any other way.

Before relying on data a person has made freely accessible as your lawful basis for collecting it, confirm your use fits the context in which the person made it accessible; freely accessible data supports the legitimate-interest basis but is not an exemption from the Act's other duties.

Document a balancing assessment showing your interest clearly overrides the affected individuals' rights, and adopt the named technical and procedural safeguards, including a disclosure, impact assessment, and an erasure or objection mechanism.

A scraper collecting the personal data of an individual in onshore UAE from a public, unauthenticated page must still establish a lawful basis under Art. 4 for any use beyond the narrow act that made the data public, and must treat a biometric identifier derived from public photographs, video, or audio as Sensitive Personal Data requiring explicit consent.

If your AI system handles data classified as confidential, reserved or personal, comply with the risk-evaluation framework the Agencia Nacional de Inteligencia Artificial (ANIA) sets.

When you use personal data to develop, research or apply AI, comply with the Ley para la Protección de Datos Personales, under ANIA and ACE supervision.

If you are the deployer of a high-risk AI system and you are separately required to carry out a data protection impact assessment under the GDPR or the Law Enforcement Directive, use the information the provider supplies you under Article 13 in that assessment.

Make prominent written disclosure of your use of artificial intelligence in utilization review in your policies and procedures, review its outcomes periodically for accuracy, and keep patient data used in that review within its stated purpose under HIPAA.

Where you use AI for administrative support, ensure the use complies with HIPAA, HITECH, and Nevada's own health-information privacy statutes (NRS 439.581 to 439.597).

Do not use data obtained through a judicially-authorized surveillance measure for any purpose other than the investigation it was gathered for.

Do not create a data bank or computerized record containing data that could affect a person's privacy.

Do not share an applicant's video except with a person whose expertise or technology is necessary to evaluate fitness for the position.