Purpose limitation and transparency: Under existing data-protection principles, which concern is most directly
Reusing order-fulfillment data to train a model without new notice chiefly implicates purpose limitation and transparency.
The question
A retailer collected customer purchase histories to fulfill orders and now wants to reuse that data to train a churn-prediction model, without any fresh notice to customers. Under existing data-protection principles, which concern is most directly raised?
Preparing for AIGP? Take the free 5-min readiness quiz →
- Data minimization, because the retailer is retaining too many attributes per record and must delete fields before it can lawfully build any predictive model from the dataset.Plausible because minimization is relevant, but the core issue here is repurposing data collected for a different aim without a compatible basis or notice.
- Cross-border transfer restrictions, because analyzing the purchase data for churn prediction inevitably moves the personal data outside its original jurisdiction during model training.Almost plausible but transfer rules only apply if data actually crosses borders; the scenario's issue is repurposing, not international transfer.
- Purpose limitation and transparency, because data gathered for order fulfillment is being repurposed for model training without a compatible basis or updated notice to customers. ✓Correct: reusing data for a new, potentially incompatible purpose without informing customers directly implicates purpose limitation and transparency duties.
- Breach notification, because using existing data for a new model constitutes an unauthorized disclosure that the retailer must report to the supervisory authority within the deadline.Plausible-sounding but internal repurposing is not a personal-data breach, so breach-notification duties are not the principle engaged here.
The trap
Treating internal repurposing of data as a breach or a minimization problem rather than a purpose-limitation issue. How to remember it
Reusing order-fulfillment data to train a model without new notice chiefly implicates purpose limitation and transparency.
How many of these would you get right?
One of 1581 AIGP questions on Certsqill. Take a free five-minute check and see your score per domain — not one number, but which section to open tonight.
Test your AIGP readiness — freeMore Understanding How Laws, Standards and Frameworks Apply to AI questions
- ISO/IEC 42001: Which ISO/IEC standard fits, and how does it differ from its companions? →
- Data minimization and privacy by design: Which data-protection concept does this approach most directly →
- A Data Protection Impact Assessment: Under GDPR controller obligations, which step is required before →
- All 394 Understanding How Laws, Standards and Frameworks Apply to AI questions →
Part of the Certsqill AIGP question bank · Understanding How Laws, Standards and Frameworks Apply to AI ·
Every answer, right and wrong, comes with its own explanation.
