A company trains an AI model on customer support chat logs that include sensitive personal information. The company did not obtain explicit consent for AI training as a purpose. Under GDPR, which legal basis would MOST plausibly support this use?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — a is correct because legitimate interests (GDPR Article 6(1)(f)) could potentially support AI training on existing operational data if the company conducts a legitimate interests assessment (LIA) demonstrating necessity, proportionality, and that interests outweigh data subjects' rights — though this is a contested area requiring careful analysis. B is the wrong category — vital interests applies to life-or-death situations.
Full explanation below image
Full Explanation
A is correct because legitimate interests (GDPR Article 6(1)(f)) could potentially support AI training on existing operational data if the company conducts a legitimate interests assessment (LIA) demonstrating necessity, proportionality, and that interests outweigh data subjects' rights — though this is a contested area requiring careful analysis. B is the wrong category — vital interests applies to life-or-death situations. C misapplies public task, which applies to official authorities. D is incorrect as no such legal obligation exists.