Secondary Use Beyond Collection Purpose
蒐集目的外的二次利用
When an organization repurposes operational data accumulated by an existing system to train a model for a new product, without reassessing purpose compatibility; due to unmitigated control gaps, an audit finds this violates the original collection purpose, requiring deletion of the resulting training artifacts and re-acquisition of data, significantly delaying the project, triggering compliance exposure and operational reputational costs.
Framework Mappings
Risk Treatment & Implementation Guidance
Track data purposes so any repurposing for training first passes a compatibility assessment against the original collection purpose; Cure the legal basis before use where purposes are incompatible, documenting the assessment; Build data-lawfulness confirmation into project schedules so assessment is not skipped under time pressure