The Bottom Line
- Your existing privacy policy may not cover using customer data for new AI-driven tools; specific, granular consent is increasingly the standard.
- Companies risk significant fines and may be forced to halt data processing for innovative projects if they rely on broad, pre-existing user agreements.
- A proactive review of data consent mechanisms is now critical, especially for businesses developing or deploying AI and machine learning applications for marketing or profiling.
The Details
In a decision with significant implications for the tech and data-driven sectors, a Dutch court has sided with the data protection authority, reinforcing the need for explicit and specific user consent when repurposing customer data for new technologies. The case centered on a company that used its existing customer database to train a new, sophisticated AI marketing tool. The company argued that its general privacy policy, which users had previously accepted, was sufficient legal ground. The court, however, firmly rejected this argument, signaling a move towards stricter interpretations of GDPR principles.
The court’s reasoning focused on the core GDPR tenets of “purpose limitation” and “informed consent.” It determined that using data to power a complex AI profiling model constituted a fundamentally new purpose—one that customers could not have reasonably foreseen when they initially provided their data. The judgment emphasized that true consent must be unambiguous and specific to the processing activity. A vague, catch-all clause in a years-old privacy policy does not meet this high standard, particularly when the new processing involves advanced, and potentially intrusive, technologies like AI.
For CEOs and General Counsel, this ruling is a clear warning shot. The era of leveraging historical data for any and all future innovations without re-engaging the user is closing. It underscores that data privacy cannot be an afterthought; it must be a core component of the product development lifecycle (“privacy by design”). Businesses planning to deploy AI tools that rely on personal data must now question whether their existing consent frameworks are robust enough. The message from the court is clear: innovation and compliance must go hand-in-hand, and failing to secure fresh, specific consent for new data uses is a significant legal and financial risk.
Source
Source: Rechtbank Zeeland-West-Brabant
