Question 34
UnclassifiedA company wants to reuse archived customer data for a new AI model. What should happen first?
Correct answer: B
Explanation
Before reusing archived customer data, the company must verify that the new AI use fits the original purpose and any limits tied to notice, consent, retention, and governance. Data governance requires checking whether the use matches prior disclosures and complies with legal restrictions and approvals before processing begins.
Why each option is right or wrong
A. Nothing, because archived data is outside the privacy program
B. The company should assess whether the new use matches prior disclosures, legal restrictions, retention rules, and governance approvals
Under GDPR Article 5(1)(b) and (e), personal data must be collected for specified, explicit purposes and not kept or repurposed beyond what is necessary, so archived customer data cannot be fed into a new AI model until the organisation checks purpose compatibility and retention limits. If the new processing is outside the original notice or consent basis, Article 6 requires a valid lawful basis before reuse, and any sectoral or contractual restrictions plus internal governance approvals must be cleared first.
C. The company should publish the model weights publicly
D. The company should delete the training data immediately