Free GDPR assessments that find what you didn't know to ask

What we relied on

You told us: the tickets come straight from your customers; you first collected them to give support; your privacy notice does not mention AI training; people cannot opt out; you remove names and email addresses before training; you tried synthetic examples and they were too thin; the helpdesk tool stores the data in the EU.

Assumed: the tickets rarely contain sensitive details, because you answered "Not sure" (see gap 1 below).

Still unknown: whether removing names also catches personal details written in free text.

The rules

• 1 Law · GDPR Art. 5(1)(b): data collected for one purpose can be used for another only if the new purpose is compatible with the first.
• 2 Law · GDPR Art. 6(4): five things decide whether a new purpose is compatible: the link between the purposes, the context and what people would expect, the kind of data, the possible consequences, and the safeguards.
  What does this rule say?

  If you want to use data for something new, ask five questions. How close is the new use to the old one? Would people expect it, given how they gave you the data? How sensitive is the data? What could go wrong for the people involved? What protections do you have? If the answers mostly point the same way, that tells you whether the new use fits.

• 3 Law · GDPR Art. 6(1)(f): you can rely on legitimate interests if you have a real reason, you need the data for it, and it does not outweigh people's rights.
• 4 Law · GDPR Art. 13(3): tell people before you use their data for a new purpose.
• 5 Law · GDPR Art. 21(1): when you rely on legitimate interests, people can object, and you must stop unless you can show compelling grounds.
  What does this rule say?

  If you rely on legitimate interests, people can object to your use of their data. Once they do, you must stop, unless you can show a very strong reason that outweighs their interests.

• 6 Official guidance · ICO on legitimate interests: guidance suggests working through three questions, purpose, necessity and balancing.

Applying the rules

Does the new use fit the old one (Art. 6(4))? 2

• Link between the purposes: training a support assistant is close to giving support. Points toward compatible.
• What people expect: customers wrote tickets to get help, and many would not expect their messages to train a model. Points against.
• Kind of data: mostly free text, which can hold personal details. Mixed.
• Consequences: low for individuals if personal details are removed, higher if the model repeats them. Mixed.
• Safeguards: you remove names and email addresses. Points toward, but untested on free text.

Do legitimate interests work as the basis (Art. 6(1)(f))? 3 6

• Purpose: improving your support is a real business interest.
• Necessity: you tried synthetic examples and they were too thin, so real tickets are needed.
• Balancing: this holds only if people are told and can opt out.

Conclusion

Proceed with safeguards.

Because we cannot see how well your filter catches personal details in free text.

This would change if: the tickets hold health or other sensitive details at scale (then Art. 9 applies and legitimate interests cannot carry it alone 7), or customers were promised their tickets would only ever be used for support.

What to do

1. 1.Tell current and new customers about the AI training before it starts. You can fix this yourself
2. 2.Add an easy opt-out and honour it. You can fix this yourself
3. 3.Test that your filter catches personal details in free text. You can fix this yourself
4. Gap 1 (from the data map): find out whether the tickets contain sensitive details.