A library considers sending EU resident library-use data to an unapproved overseas model trainer. What compliance stance is correct?
Select an answer to reveal the explanation.
Short Explanation
EU patron data doesn’t become free-range just because it’s a library. No unapproved overseas trainers without transfer safeguards—full stop.
Full Explanation
The correct compliance stance is to avoid exporting EU resident library-use data to unapproved overseas model trainers without transfer safeguards. Library-use data can identify or relate to natural persons; when EU residents are in scope, cross-border transfers generally require an appropriate legal mechanism, purpose limitation, and contractual/technical safeguards before a third-party trainer may process the data. Municipal libraries cannot treat “training convenience” as a lawful transfer basis.
Exporting freely because library cards are never personal data fails by concept: cardholder and usage records often are personal data and may include sensitive contextual signals. Assuming any cloud region is automatically lawful for all residents fails because location marketing is not a transfer assessment—residency, subprocessors, and adequacy/safeguards still matter. Publishing the raw dataset on the open web first to simplify training fails because public dumping multiplies privacy harm and does not create lawful training rights.
Exam caveat: “unapproved trainer” includes informal vendor side-channels and research partners; absence of a procurement record does not exempt the transfer from safeguards. Operational check: inventory EU-resident library-use fields in AI pipelines, block egress to unapproved trainers by default, and require documented transfer mechanism plus DPA/SCC (or equivalent) review before any overseas training use.