A generative-AI chatbot logs EU users' prompts that include diagnoses and medication details for model improvement. Which risk framing is most accurate under GDPR?
Select an answer to reveal the explanation.
Short Explanation
When someone pastes 'my diabetes meds' into a bot, you just caught special-category data in the logs. Calling it telemetry does not downgrade Art. 9. Lock down the pipeline, explain the use, and get a proper Art. 9 route—or do not keep it.
Full Explanation
A generative-AI chatbot that logs EU users’ prompts containing diagnoses and medication details for model improvement most accurately raises that ingesting prompts with health details raises Article 9 special-category issues plus transparency and security duties for the AI logging pipeline. Pasting ‘my diabetes meds’ into a bot catches special-category data in the logs; calling it telemetry does not downgrade Article 9. Claiming chat prompts are never personal data if the account uses a nickname fails when content identifies health information linkable to a user. Saying health details in free text are ordinary data because the user typed them voluntarily fails—voluntariness of input does not erase special-category status. Asserting model-improvement logs are exempt from Article 9 whenever labelled ‘telemetry’ fails labelling theatre. Exam caveat: controllers need both an Article 6 basis and an Article 9 condition to process health data for model improvement, plus strict retention, access control, and clear notices—or they should not retain such prompts. Operational check: detect and redact health content from training logs, disable improvement logging for sensitive chats, document Art. 9 grounds if processing continues, encrypt and access-restrict corpora, and update transparency texts.