Whether the team can establish lawful basis and purpose: What is the decisive issue before reuse?
Public availability is not a blanket exemption; lawful basis and compatible purpose remain decisive under the EU GDPR.
The question
In a customer-service operation subject to the EU GDPR, a team wants to train an AI assistant on customer reviews posted publicly online. The reviews contain names and complaints, and the team proposes relying solely on their public availability. What is the decisive issue before reuse?
Preparing for AIGP? Take the free 5-min readiness quiz →
- Whether the reviews are accessible without a loginOpen accessibility does not itself establish a GDPR lawful basis, compatible purpose, transparency, or other processing safeguards.
- Whether the team can establish lawful basis and purpose compatibility ✓GDPR requires a lawful basis and assessment of compatible reuse; public availability alone does not remove those obligations.
- Whether the reviews contain enough text for model trainingTraining volume concerns utility, not the decisive legal basis and purpose requirements governing personal-data reuse under GDPR.
- Whether the vendor contract prohibits publishing the trained assistant’s outputsOutput publication terms may matter, but they do not establish a lawful basis for processing the source personal data.
The trap
Public source data remains personal data when individuals can be identified; test legal basis and purpose separately. How to remember it
Public availability is not a blanket exemption; lawful basis and compatible purpose remain decisive under the EU GDPR.
How many of these would you get right?
One of 1581 AIGP questions on Certsqill. Take a free five-minute check and see your score per domain — not one number, but which section to open tonight.
Test your AIGP readiness — freeMore Understanding How Laws, Standards and Frameworks Apply to AI questions
- The tool may cause unlawful disparate impact: Under nondiscrimination law, what is the primary legal risk even →
- The new counseling prediction purpose must be assessed: Which distinction controls the reuse analysis? →
- A non-consent basis must still satisfy GDPR conditions: What is the decisive distinction? →
- All 394 Understanding How Laws, Standards and Frameworks Apply to AI questions →
Part of the Certsqill AIGP question bank · Understanding How Laws, Standards and Frameworks Apply to AI ·
Every answer, right and wrong, comes with its own explanation.