Engineering, production, governance, cost, communication · insight-1286
Check each new model use against the purpose the data was collected for
- Evidence type
- documented fact
- Difficulty
- medium
- Roles
- Data scientist, ML engineer, Applied AI
- Industries
- cross-industry, telecom, retail
Summary: situation, action, reason, boundary
Situation
Support-chat transcripts gathered to resolve tickets are proposed as training data for a sales-propensity model (hypothetical, EU customers).
Action
Record each dataset's original purpose and lawful basis in its catalogue entry, add a purpose check to project intake, and get privacy-owner sign-off or fresh consent before building on a new use.
Reason
GDPR requires personal data to be collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with them.
Boundary
Teams reusing operational, support or telemetry data to train new models.
Symptom or risk
The new use may be incompatible with the original purpose, which can force deletion of the training set and a retrain after the model is built.
Exceptions
Statistical, research and archiving uses get a compatibility presumption with safeguards; anonymised data is outside scope; non-EU regimes differ.
Trade-offs
Intake review adds days; pre-approve common uses to keep it cheap.
Pitfalls
Treating ownership of the data as the answer to a purpose question.
Lessons and concepts
Claims and their sources
GDPR Article 5(1)(b) requires collection for specified, explicit and legitimate purposes and no further processing incompatible with them, with a compatibility presumption for archiving, research and statistics under safeguards.