Reusing Support Transcripts for Model Training

The notice does not cover the new purpose.

Stated purposes are enquiry resolution and quality assurance, with deletion at 90 days. Model development is a different purpose with a different retention period. Under the privacy principles the organisation has committed to - lawfulness and fairness, purpose limitation, transparency, minimisation, storage limitation - reuse for a new purpose needs either a documented compatibility assessment supporting the original basis, or a new lawful basis plus an updated notice. ISO/IEC 27002 expects the organisation to identify and meet its privacy requirements, including purpose and retention, not merely to avoid prosecution. The published notice is itself a commitment.

'It only learns patterns' is not an anonymisation argument.

• Models can memorise and later emit training data, particularly with repeated, rare or distinctive samples - and customer conversations are full of distinctive details.
• The training corpus, checkpoints and intermediate datasets are all still personal data at rest, and they persist far beyond 90 days.
• The 6% containing card fragments and volunteered health information raises both payment-card scope and special-category exposure.

Conclusion

The project can proceed only with a defined lawful basis, an updated notice, a documented assessment, and a minimised and de-identified corpus. It cannot proceed on the current notice. Keeping 24 months of recordings also already conflicts with the stated 90-day deletion, which is a separate finding regardless of the training decision.

The copy: treat it as an incident, not a mistake.

• Contain first: revoke sharing on the bucket, delete the copy, confirm no further copies or sync clients, preserve any evidence needed for the assessment.
• Assess: what data left the controlled environment, whether it was encrypted, who could reach it, whether it included the card and health fragments, and what notification obligations arise.
• Record and escalate through the incident process. Root cause is the absence of a controlled data pipeline: production personal data should never be in a test environment, egress should be restricted, and bulk copy should be visible. Data leakage prevention and access restriction are the missing controls.

The vendor offer: decline unless the basis exists.

• 'Free, in exchange for using the data' means the consideration is the data. The vendor's product improvement is a new purpose the insurer has no lawful basis to grant, and no notice covers.
• It also creates a new processor or controller relationship, cross-border questions and supply-chain risk. Supplier due diligence, agreed security and data-protection terms and an assessment come before any transfer, never after.
• Being free is a reason for more scrutiny, not less, because the commercial logic depends on extracting value from the data.

Judgement

The copy is the urgent containment problem. The vendor offer is the strategic one: accepting it would convert an internal reuse question into an uncontrolled third-party disclosure.

Data-level controls

• De-identification and masking of the corpus: strip or tokenise card fragments, redact health details, remove direct identifiers. This reduces both regulatory exposure and the amount the model can memorise.
• Minimisation and sampling: fewer months, fewer records, exclude the 6% entirely. If the task does not need 24 months, do not train on it.
• Information deletion: define a retention period for the corpus, derived datasets, checkpoints and evaluation sets, and purge on schedule. Extending retention for training must be stated in a revised notice, not assumed.

Environment controls

• Access restriction and strong authentication for the training environment, restricted to the project team.
• Separation of development, test and production, with no production personal data in test.
• Encryption of the corpus and model artefacts at rest and in transit.
• Logging of access to the corpus, plus egress monitoring and leakage prevention on the training environment.

Assurance controls

• A documented assessment of the new purpose, the lawful basis and the residual risk, approved before work starts.
• Memorisation and extraction testing before the model is released, with a documented threshold for what counts as acceptable leakage.
• An updated privacy notice and a defined incident path if training data is later exposed.

Why this set

The specific harm here is not 'someone reads the transcripts' - it is reconstruction of personal data from a model or dataset that has left its original purpose. Controls must target concentration, memorisation and egress, not just perimeter access.