Step by Step
C
Consent — agreement, with the right to withdraw
Data subjects must agree to how their data is used, and critically, they retain the right to withdraw that consent at any time.
Example: a user initially consenting to have their data used for a specific AI feature, then later exercising their right to withdraw that consent entirely.
P
Purpose limitation — no repurposing without new consent
Data collected for one specific purpose cannot be reused for an entirely different purpose without obtaining new, separate consent for that new use.
Example: data collected specifically for improving a customer support chatbot not being reused to train an entirely different marketing AI system without first obtaining fresh consent for that new purpose.
D
Data minimization — collect only what is necessary
Organizations should collect only the data that is genuinely necessary for their stated purpose, not simply everything they could technically gather.
Example: an app collecting only the specific data points genuinely required for its core functionality, rather than broadly collecting anything potentially useful.
⚡
AI-specific rights — explanation, opt-out, and erasure
For AI specifically, these regulations create additional rights: the right to explanation for automated decisions (GDPR Article 22), the right to opt out of automated processing entirely, and the right to erasure ("right to be forgotten") — which becomes legally and technically complicated when personal data is baked into a model's trained weights.
Example: an individual invoking their right to erasure under GDPR, which then raises the complicated technical question of how to actually remove their specific influence from a model's already-trained weights, rather than just deleting a database record.
Applied Walkthrough
1
A company collects user data specifically to improve their customer support chatbot, with users explicitly consenting to that specific stated purpose.
2
Later, the company considers reusing this same data to train a completely different AI system for targeted advertising.
3
Ask: can they do this using only their original consent? No — purpose limitation requires obtaining new, separate consent specifically for this new, different purpose, since the original consent only covered the chatbot use case.
4
If a user later requests erasure of their data under GDPR's "right to be forgotten," the company faces the added complication that this individual's data may already be baked into their trained model's weights, not just stored in an easily deletable database record — a technically and legally complex situation known as machine unlearning.
Exam Application
Exams test whether you can name and describe the three core privacy pillars (consent, purpose limitation, data minimization) and the AI-specific rights these create (right to explanation, right to opt out, right to erasure), and whether you understand why the right to erasure is particularly complicated for AI models specifically, given that personal data can become embedded in trained model weights.
⚠ Common Trap
The most common trap is assuming consent obtained for one purpose automatically covers any future use of that same data. Purpose limitation specifically requires new consent whenever data is repurposed for a genuinely different use than what was originally agreed to.
✓ Quick Self-Check
1. What does the consent pillar require, beyond just initial agreement?
Data subjects must agree to how their data is used, and retain the right to withdraw that consent at any time.
Tap to reveal / hide
2. What does purpose limitation require if a company wants to reuse data for a new purpose?
New, separate consent specifically for that new purpose — the original consent doesn't automatically cover it.
Tap to reveal / hide
3. What does data minimization require?
Collecting only the data that is genuinely necessary for the stated purpose, not everything technically possible.
Tap to reveal / hide
4. What GDPR article specifically creates a right to explanation for automated decisions?
GDPR Article 22.
Tap to reveal / hide
5. Why is the "right to be forgotten" particularly complicated for AI models?
Because personal data may be baked into a model's trained weights, not just stored in an easily deletable database record, making full removal technically and legally complex.
Tap to reveal / hide