A generative-AI chatbot logs EU users' prompts that include diagnoses and medication details for model improvement. Which risk framing is most accurate under GDPR?
Select an answer to reveal the explanation.
Short Explanation
When someone pastes 'my diabetes meds' into a bot, you just caught special-category data in the logs. Calling it telemetry does not downgrade Art. 9. Lock down the pipeline, explain the use, and get a proper Art. 9 route—or do not keep it.
Full Explanation
Data concerning health are special-category personal data under Art. 9, whether structured fields or free-text prompts. Logging such content for generative-AI improvement typically requires an Art. 9 condition in addition to an Art. 6 basis, plus heightened security, retention control, and transparency. Controllers must not rely on informal labels like telemetry to avoid special-category rules.