NIST AI RMF, MeasureMEASURE 2.10

Scraping personal data from a public source excuses obtaining the data subject's consent, but does not excuse registering the resulting file or database, keeping the data accurate and secure, or observing the cross-border transfer restriction.

Do not collect personal information, including personal information scraped from a public website, unless it is reasonably necessary for one or more of the entity's functions or activities.

Do not use or disclose personal information collected for one purpose for another purpose, including model training, unless the individual consented or an Australian Privacy Principle 6.2 exception applies.

An app scraping personal data that was made public by someone other than the data subject, or without the subject's consent, does not benefit from the open-category ground and needs a separate lawful basis under Art. 9.6 before collecting or processing it.

Establish a lawful basis before collecting or processing personal data scraped from a public Barbadian website; public availability is not itself an exemption.

Do not scrape or otherwise process a biometric identifier unless the data subject consents or a specific statutory ground applies.

Do not treat personal data scraped from a third-party aggregator, directory, or re-posting site as publicly available under the CCPA merely because it appears on a public page; the exemption reaches only lawfully available government records, information lawfully made available to the general public by the consumer or from widely distributed media, and information made available by a person to whom the consumer disclosed it without restricting the audience.

Apply PIPEDA's purpose-limitation and accountability obligations to personal information collected by crawling, the same as personal information collected any other way.

Before relying on data a person has made freely accessible as your lawful basis for collecting it, confirm your use fits the context in which the person made it accessible; freely accessible data supports the legitimate-interest basis but is not an exemption from the Act's other duties.

Collect and use personal information without consent on this ground only where it is necessary to attain your legitimate interests and those interests are manifestly superior to the data subject's rights.

A scraper collecting the personal data of an individual in onshore UAE from a public, unauthenticated page must still establish a lawful basis under Art. 4 for any use beyond the narrow act that made the data public, and must treat a biometric identifier derived from public photographs, video, or audio as Sensitive Personal Data requiring explicit consent.

Make prominent written disclosure of your use of artificial intelligence in utilization review in your policies and procedures, review its outcomes periodically for accuracy, and keep patient data used in that review within its stated purpose under HIPAA.

If you are an attorney who uses generative AI to assist in the practice of law, do not enter confidential, personal identifying, or other nonpublic information into a generative AI system unless access to what you input is restricted to you and persons you authorize under obligations to protect its confidentiality

If you offer a health care chatbot to a consumer to manage the consumer's information or for diagnosis, treatment, or management of a medical condition, handle the information as a provider of health care under the Confidentiality of Medical Information Act

If you are a school using an artificial intelligence application in teaching, process a pupil's personal data only for that purpose, keep it for no more than three months after the pupil leaves the school, and give no school representative access to the data the pupil enters while using the application (Kutseõppeasutuse seadus (Vocational Educational Institutions Act), section 32^1(1) to (5)).

If you are a school using an artificial intelligence application in teaching, process a pupil's personal data only for that purpose, keep it for no more than three months after the pupil leaves the school, and give no school representative access to the data the pupil enters while using the application (Põhikooli- ja gümnaasiumiseadus (Basic Schools and Upper Secondary Schools Act), section 20^1(1) to (5)).

The Commission says that, in line with section 34 of the Data Protection Act 2017, you must conduct a Data Protection Impact Assessment before implementing any AI system likely to present a high risk to the rights and freedoms of data subjects.

Where you use AI for administrative support, ensure the use complies with HIPAA, HITECH, and Nevada's own health-information privacy statutes (NRS 439.581 to 439.597).

Do not collect, use, retain, sell, share, or otherwise make available personal information derived from a user of the verification tool or from content it processes beyond what is strictly necessary, and do not make access to your system or the tool depend on a user providing personal information beyond that

Do not share an applicant's video except with a person whose expertise or technology is necessary to evaluate fitness for the position.

It would restrict a chatbot provider's processing: personal data beyond input data only where necessary for an express user request and with the user's affirmative consent; the chat logs and personal data of a user it knows or has reason to know is under 18 only with a parent's or guardian's affirmative consent and never for training; and an adult user's chat logs and personal data for training only with that user's affirmative consent.

It would bar a chatbot provider, beyond what an express user request needs, from using chat logs to choose, target or customize advertisements, from profiling users, and from using a classification of a user's personality or behavior created through profiling.

Do not use data obtained through a judicially-authorized surveillance measure for any purpose other than the investigation it was gathered for.

Do not create a data bank or computerized record containing data that could affect a person's privacy.

If you hold an authorization to access a system that processes personal data, do not process that data for purposes other than those for which the authorization was granted.

If your AI system handles data classified as confidential, reserved or personal, comply with the risk-evaluation framework the Agencia Nacional de Inteligencia Artificial (ANIA) sets.

When you use personal data to develop, research or apply AI, comply with the Ley para la Protección de Datos Personales, under ANIA and ACE supervision.

If you are the deployer of a high-risk AI system and you are separately required to carry out a data protection impact assessment under the GDPR or the Law Enforcement Directive, use the information the provider supplies you under Article 13 in that assessment.

Do not train the underlying model of an advanced chatbot with a minor's inputs unless the minor's parent or guardian gives written consent for that specific purpose.

Periodically review the AI system to ensure its outcomes are accurate and reliable and that an individual's health data is not used beyond its intended or stated purpose

Work with EESZT data for AI development only inside the secure processing environment and only with the operator's permit (Section 35/A(4) and (5)).

Use only anonymous data, and hold the scientific research permit issued by the competent ethics committee of the Health Science Council (Egészségügyi Tudományos Tanács) (Section 35/A(7)(a) and (c)).

Weigh whether processing personal data in an artificial intelligence system is suitable to the goal pursued, necessary because no less intrusive measure achieves it equally well, reasonable because it serves a constitutional purpose, and proportionate because its benefits are not outweighed by the harm to the right to data protection.