Question

A retail company collected customer purchase histories to fulfill orders and provide receipts. The data science team now wants to reuse this same dataset to train a machine learning model that predicts customer churn and targets retention offers. The original privacy notice listed only order fulfillment and customer service as processing purposes. As the privacy solutions engineer, what should you advise the team to do FIRST before proceeding?

Accepted Answer

Assess whether the churn-prediction use is compatible with the original collection purpose, and if not, establish a valid legal basis and update the notice before using the data

Answer

Pseudonymize the purchase histories so the model can be trained without further approvals

Answer

Allow the training to proceed since the data is already lawfully held by the company

Answer

Delete the dataset after the model is trained to satisfy retention limitation