A European investment firm's data science team proposes training a client churn-prediction AI model using five years of historical transaction records, behavioral data, and financial advisory notes containing personal client information. The firm's DPO flags potential GDPR compliance issues. Which action best aligns the project with GDPR requirements for AI training data?
Select an answer to reveal the explanation.
Short Explanation and Infographic
GDPR doesn't disappear just because you're building an AI model — it follows the data. Think of it as a chain of custody: every step from collection to model output needs a lawful basis and documented safeguards. Answer C covers the full compliance picture.
Full explanation below image
Full Explanation
GDPR (EU Regulation 2016/679) applies to the processing of personal data of EU data subjects regardless of the purpose — including AI model training. Financial services firms are not exempt; the Recital 47 'legitimate interests' basis and Article 6 lawful bases apply to internal analytics and AI development in the same way they apply to direct marketing or profiling.
Option A is incorrect: no blanket financial services exemption exists under GDPR for AI training. Option B misrepresents consent requirements — GDPR requires that consent be specific, informed, and granular. A broad upfront consent for 'any future AI development purposes' would likely fail the specificity test under Article 7 and Recital 32 and could be challenged by regulators.
Option D addresses a real GDPR carve-out (anonymized data falls outside GDPR scope) but critically understates the difficulty of achieving true anonymization. Tokenization is a pseudonymization technique, not anonymization — the original data remains re-linkable using the tokenization key. GDPR Recital 26 clarifies that pseudonymous data is still personal data. True anonymization is a high bar that survives regulatory scrutiny only when re-identification is effectively impossible, not merely unlikely.
Option C correctly identifies the full compliance pathway: (1) establish a lawful basis documented with a legitimate interests assessment (LIA) if relying on Article 6(1)(f); (2) apply data minimization — use only the data necessary for the model's purpose; (3) conduct a Data Protection Impact Assessment (DPIA) per Article 35 when processing is likely to result in high risk to individuals; (4) evaluate Article 22 obligations if the churn model feeds into automated decisions that produce legal or similarly significant effects on clients. CFIA candidates operating in EU-regulated environments must treat GDPR as a design constraint, not a post-hoc checkbox.