AFAIK training on API is opt-in, training on the consumer interface is opt out. And one must also say that there are enough levers in the GDPR to argue a legal basis for processing PII, not the least of which is the catch all "legitimate interest". But you need to implement appropriate controls, otherwise data privacy regulators will complain.
So basically, the training set is under the GDPR if it includes PI, but the resulting model is not (unless you can extract PI from it), and you need user permission to use PI for training in most cases, right?
Good thing I'm not relying on you for my legal questions. GDPR gives the user control over their own data, and each new use of the data requires specific consent be asked. So using PII on any person, no matter where you found it, requires explicit consent.
I assumed you need consent to receive PII, full stop. Again IANAL, but I assumed saying you don't do anything at all with the PII you receive doesn't exempt you from anything under GDPR. I may be wrong, though I hope not to be.
Under GDPR you can use all the PII you reasonably need to provide expected services, you don't even need separate consent. But, if you have PII, the moment you use it for other purposes, or obtain/retain/share without proper cause, you are breaking the law.
IMHO, that is very reasonable.
Real world example - giving your phone number and information to your car mechanic / doctor / bank teller / plumber is reasonable. Using that information to score girls or ask donation for a puppy shelter would be considered improper.
The PII is necessary to pay for the content. If you don't give consent then they can't process the data and cant offer you the service. Necessary requirements are allowed under GDPR.
GDPR can prevent extraneous data capture but it can't force companies to provide services without compensation.
This is way off base. Using PI to fulfill a request someone has made of you is the happy path of GDPR, you just can't retain or reuse that information more than you have
1) a contract or
2) permission or
3) a lawful task
For.
Having other parties process PI for you is fine as long as it's done under an agreement that binds them to the same terms.
Keeping PII for fraud detection is not barred by GDPR.
In this context the more relevant aspect of GDPR, which I think receives too little attention and more so enforcement, is article 22 (Automated individual decision-making, including profiling)
PII is not a concept of GDPR. Whether IPs are considered personal data covered by GDPR is open to interpretation, but most of the experts I've talked to say yes.
reply