Kayli Lewis @ MailSPEC @mailspec

Director of compliance strategy here at MailSPEC. We provide AI governance of communications for regulated industries. Posts on compliance and data privacy. mailspec.com Internet Joined August 2021

Tweets

54K
Followers

6K
Following

531
Likes

262K

Kayli Lewis @ MailSPEC @mailspec

2 minutes ago

@ReclaimTheNetHQ Data privacy compliance is a huge question here.

0 0 0 1 0

View Details

Kayli Lewis @ MailSPEC @mailspec

3 minutes ago

@ReclaimTheNetHQ Not so entertaining.🤔

0 0 0 0 0

View Details

Kayli Lewis @ MailSPEC @mailspec

4 minutes ago

@TechGDPR AI requires attention. And control.

0 0 0 0 0

View Details

Kayli Lewis @ MailSPEC @mailspec

5 minutes ago

@isfjcutebear Good question.

0 0 0 3 0

View Details

Kayli Lewis @ MailSPEC @mailspec

30 minutes ago

@pubity That's very likely.

0 0 0 0 0

View Details

Kayli Lewis @ MailSPEC @mailspec

37 minutes ago

@PVynckier @BillMew @robmay70 @NigelTozer @ChuckDBrooks @m49D4ch3lly @DT @archonsec @clarinette01 @jbarbosapr @AshokNellikar @MHcommunicate @Khulood_Almani @Miriam_Brown979 Interesting.

0 0 1 4 0

View Details

Kayli Lewis @ MailSPEC @mailspec

37 minutes ago

@PVynckier @BillMew @robmay70 @NigelTozer @ChuckDBrooks @m49D4ch3lly @DT @archonsec @clarinette01 @jbarbosapr @AshokNellikar @MHcommunicate Having these copies is absolutely not harmless. When someone steals them, there is a whole set of criminal activities that can be done.

0 0 1 9 0

View Details

Kayli Lewis @ MailSPEC @mailspec

38 minutes ago

@PVynckier @BillMew @robmay70 @NigelTozer @ChuckDBrooks @m49D4ch3lly @DT @archonsec @clarinette01 @jbarbosapr @AshokNellikar @MHcommunicate @Khulood_Almani @Miriam_Brown979 Automated decision making? No, doesn't sound good.

0 0 1 5 0

View Details

Kayli Lewis @ MailSPEC @mailspec

41 minutes ago

@LuizaJarovsky Yes.

0 0 0 8 0

View Details

Kayli Lewis @ MailSPEC @mailspec

2 hours ago

Product Release: CommuniGate version 8.1 is now hot off the build boxes, and ready "fresh meat" for the weekend. support.mailspec.com/en/news/posts/…

0 0 0 23 0

View Details

Kayli Lewis @ MailSPEC @mailspec

4 hours ago

A startup founder found a privacy policy template online. She changed the company name, hit save, and called it done. Cost: $0. Time: 15 minutes. Her actual data processing: collecting customer email, storing in a cloud system, running analytics, using a third-party payment processor. The template privacy policy: generic language that might apply to any company doing anything with personal data. Now, when a customer asks what happens to their personal data, the company points to a document that describes almost nothing about what the company actually does. GDPR requires that privacy notices be transparent, specific, and clearly inform individuals about data processing. That is a requirement that generic templates fail to satisfy because they describe potential processing rather than actual processing, creating documents that look compliant but actually violate GDPR's transparency requirement. Using a template saves money. But it creates a documented violation that says you tried to comply without actually understanding your own data processing. That makes enforcement worse, not better.

1 0 1 30 0

View Details

Kayli Lewis @ MailSPEC @mailspec

9 hours ago

AI training on customer data is not a gray area anymore. The EDPB has been explicit: personal data used to train AI models requires a separate documented legal basis for the training activity. Here is what that means in practice: If you collected customer data to provide a service, you cannot use that data to train an AI model unless you have a separate legal basis for training. "They agreed to our terms of service" does not count. Consent to use a service is not consent to have your data used to improve AI. Organizations are making calculated bets that the business value of better AI training data exceeds the compliance risk of eventual enforcement, and so far, that bet has not been tested at scale because enforcement on this specific violation pattern is just beginning. The EDPB made clear that this is now a priority enforcement area. Here is what you need to do if you are training AI on customer data: Stop using undisclosed customer data for training. If your customers did not explicitly consent to AI model training, you cannot use their data for it. Document a lawful basis for training. If you want to use customer data for AI training, you need a separate legal basis that specifically covers training, not just service delivery. Disclose AI training in your privacy notice. Customers need to know their data might be used to train AI, and they need to have a choice about it. Get explicit consent for training. The safest legal basis for AI training is explicit consent that specifically mentions AI model training, not buried in service terms but explicitly asked for. Consider synthetic or anonymized training data. The EDPB confirmed that personal data used in AI training rarely achieves true anonymization, so the only truly safe option is using data that was never personal or getting explicit consent. Organizations that get explicit consent for AI training will have defensible models. Organizations that are training AI on undisclosed customer data are building on violations that will eventually be enforced. The only question is when.

3 0 1 67 2

View Details

Kayli Lewis @ MailSPEC @mailspec

a day ago

A support director wanted to improve response times. She trained an AI on all the support conversations her team had handled over the past three years. The AI got really good at predicting what customers would ask and what the right answer was. Response quality improved 40%. Everyone was happy. Then a compliance officer asked: "Did all those customers consent to having their conversations used to train an AI?" The answer was no. Now the company is sitting on an AI system trained on undocumented GDPR violations, and they have two choices: delete the model and start over, or keep using it and wait for enforcement. Most are choosing option two. But they are doing it with their eyes open.

0 1 2 98 0

View Details

Kayli Lewis @ MailSPEC @mailspec

a day ago

Your customer data might be training the AI that your company uses. You probably never told them that. The EDPB confirmed that AI training on personal data requires a separate legal basis. Yet, most organizations using customer data to train AI models have never documented that legal basis or disclosed it to the customers whose data is being used. Your customer data is building your AI. And they probably have no idea.