Training on Personal Data Without Consent

When an organization uses accumulated user data from an existing service to train a new model without obtaining separate consent; due to unmitigated control gaps, after users raise objections, the authority opens an inquiry into whether the use exceeded the original collection purpose, and the organization faces demands to cease processing and delete the model, triggering compliance exposure and operational reputational costs.