The Scraped Profile Business

No. PIPL Article 27 permits processing of PI that the individual has disclosed or that is otherwise lawfully disclosed, but only within a reasonable scope and consistent with the purpose of the disclosure. The individual's explicit refusal must be honored. If processing has a significant impact on the individual's rights, Article 27 requires consent. Scraping social media posts, e-commerce reviews and forum comments at scale, then inferring health, religion and income, goes well beyond the original disclosure context. It is not a reasonable scope. The inferred attributes are sensitive PI under Article 28: health, religious belief and specific identity or financial status can fall within the sensitive categories. Article 29 requires a specific purpose, sufficient necessity and separate consent. A generic “publicly available information for marketing” clause does not provide that. The source of the scraping may also be unlawful, for example if it breaches platform terms, computer crime rules or the individual's explicit refusal. “Public” is not a legal basis; it is a factual condition that still limits purpose and scope. ProfileWorks should map each data source, stop inferences that create sensitive attributes without consent, and obtain fresh separate consent or another legal basis.

First, the inferred health, religion and income attributes are sensitive PI. Article 28 requires specific purpose and sufficient necessity, and Article 29 requires separate consent. Second, selling audience segments to 200 advertisers is third-party provision under Article 23, requiring notice of each recipient and separate consent. Third, the creditworthiness model is automated decision-making under Article 24. ProfileWorks must be transparent, avoid unreasonable differential treatment, and give individuals an explanation and a right to refuse a decision that significantly affects them. More seriously, providing credit scoring to a lender may constitute personal credit information business under the Regulations on the Administration of the Credit Reporting Industry, which requires a license. ProfileWorks should not operate that model without a licensed partner or its own license. Fourth, because it processes PI of more than 1 million people, Article 52 requires it to designate a person in charge of personal information protection and report the person's name and contact details to the CAC. It has not done so. Fifth, Article 55 requires a DPIA for sensitive PI, automated decision-making and third-party provision. The absence of DPIAs is itself a compliance gap.

Immediately suspend the scraping, the sensitive-attribute inference and the credit-scoring product. Preserve records, but stop further sale of the affected segments. Build a data map that shows sources, legal bases, inference logic, recipients and retention. Conduct a DPIA for each high-risk processing activity, appoint a person in charge under Article 52 and file the required information with the CAC, and adopt a rights-request process for access, correction, deletion and refusal. Send stop-processing and deletion notices to the ad-tech resellers, and re-paper future sharing with Article 23 notices and separate consent. For the lender product, either stop it or restructure it with a licensed credit reporting agency; do not rely on a disclaimer. Update the privacy policy to remove the “public data” blanket claim and give specific notices. Cooperate with the CAC, provide the requested documents, and explain the remediation timeline. Because the data includes sensitive inferences, consider whether individual notification and deletion are needed. The company should also assess civil liability under Article 69 and public-interest suit risk. A credible remediation plan should be evidence-based, with owners and deadlines, not just a policy rewrite.