A company trains an AI model on customer support chat logs that include sensitive personal information. The company did not obtain explicit consent for AI training as a purpose. Under GDPR, which legal basis would MOST plausibly support this use?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — you'd pick legitimate interests because it can support AI training on existing operational data if you run a legitimate interests assessment showing necessity, proportionality, and that the company's interests outweigh customer rights. Vital interests doesn't fit because it's for life-or-death emergencies.
Full Explanation
Legitimate interests under GDPR Article 6(1)(f) could potentially support AI training on existing operational data if the company conducts a legitimate interests assessment (LIA) demonstrating necessity, proportionality, and that the company's interests outweigh data subjects' rights — though this is a contested area requiring careful analysis. The vital-interests answer is the wrong category because vital interests applies to life-or-death situations, not AI model improvement for company survival. The public-task answer misapplies public task, which applies to official authorities rather than private companies with an implicit public interest in improving customer service. The legal-obligation answer is incorrect because no such legal obligation requires companies to train AI models to comply with consumer protection law.