EU retailer personalisation: vendor terms and shadow AI
Lumière, an EU-based online fashion retailer, wants to use generative AI to write personalised marketing emails from 40,000 customer reviews. The chosen US vendor's standard terms: prompts and outputs retained for 30 days for abuse monitoring, used to improve models unless the customer opts out, sub-processors in three countries, and no signed data processing agreement yet. A marketer has already uploaded a spreadsheet containing names, emails and order histories to a free consumer chatbot to 'test the idea'. The reviews include named employees and a complaint about a medical condition. The company's privacy notice does not mention AI processing. The launch is scheduled in three weeks. The retailer has 2.1 million EU customers and a separate UK subsidiary.
1. Identify the main legal, ethical and security issues and rank them by urgency.
Read the worked answer
Rank by immediate harm. (1) The free-chatbot upload is a likely personal-data breach: names, emails and order histories went to a consumer service with unclear retention and training use, without a lawful basis or notice. (2) The vendor terms create a processor and transfer problem: no DPA, 30-day retention, model training unless opted out, sub-processors in three countries - for EU data this needs a transfer impact assessment and safeguards. (3) Transparency: the privacy notice does not mention AI processing. (4) Special-category data: a medical-condition complaint and named employees require extra care. (5) Ethical and brand risk from generating marketing copy about identifiable people. Copyright in reviews is a lesser but real issue; the retailer should confirm it has rights to use review text.
2. Recommend controls before launch and state which are go/no-go conditions.
Read the worked answer
Go/no-go controls: stop all use of free consumer chatbots for customer data immediately; preserve logs and run an incident assessment to decide whether breach notification is required. Make vendor signing conditional on a DPA, documented instructions, opt-out from training, retention limits, sub-processor list and transfer safeguards. Complete a DPIA because the processing is large-scale and involves profiling and marketing. Update the privacy notice and lawful-basis assessment. Redact names and any health data before prompting; ideally use aggregated themes and synthetic examples rather than raw reviews. Add an AI acceptable-use policy, approved-tool list and training. Launch should be no-go until the DPA, transfer assessment, DPIA and notice are complete; the free-chatbot incident may itself require notification.
3. Advise on using reviews that name employees and mention a medical condition.
Read the worked answer
Do not put named employees or health complaints into prompts. Names are personal data and the health reference is special-category data; using it to generate marketing copy would be intrusive and hard to justify. Anonymise at source: remove names, order IDs and free-text health details, and replace with generic descriptors. Use only aggregated, non-identifiable themes for copy generation, or obtain explicit consent for testimonials. Keep a human review of any output that references a real person. If the business wants to use a specific review, get permission from the reviewer and record it. Otherwise, model the tone and themes from anonymised text. This reduces legal risk and avoids generating copy that could embarrass or identify a customer.