Drill 100 — The Consent That Expired

Theme: Compliance, Privacy & Model Governance · Format: 20-min drill · Difficulty: core

The story

A card issuer's fraud platform collects rich signals on every applicant and transaction: device fingerprints, geolocation, merchant sequences, login cadence. The consent notice customers accept at onboarding is specific — the data is collected "to detect and prevent fraud on your account" — and buried in the retention schedule is a limit: fraud signals are kept for twenty-four months past the last transaction, after which the lawful basis to hold them lapses. For years the platform does exactly one thing with the data: it scores transactions for fraud. Unremarkable, compliant, boring.

Three years on, a data-science team stands up a next-best-offer model for the marketing org. Someone remembers the fraud tables — device type, spend patterns, session behavior — and realizes they are a goldmine of engagement signal. The warehouse grant is valid, the SQL is trivial, and the historical depth is exactly what a propensity model wants. They train on it. The model lifts campaign conversion by a healthy margin, and the reuse never surfaces in any review, because nothing about training a model on a table you can already read looks like a decision that needs sign-off.

Then a data-protection regulator opens a routine examination of the marketing program and asks a single question: what is the lawful basis for training this model on fraud-prevention data? The team goes looking for the answer. The consent covered fraud, not marketing. And the twenty-four-month retention window on much of that data closed over a year ago — the records should have been expired, but nobody tracked the clock. The data was used for a purpose it was never consented for, after the consent to hold it at all had already expired.

⏸ Stop here and ask the room: the regulator wants the lawful basis in writing. What do you hand them?

Run it — facilitator script

Timing: ~2 min story · ~10 min questions · ~3 min reveal · ~5 min transfer.

Read the story aloud, pause at the blockquote, and let the room feel the trap: no access rule was broken and no data was stolen. The drill lands when someone realizes there are two violations stacked on top of each other — wrong purpose, and expired basis — and the platform could express neither.

The regulator asks for a lawful basis. Name every reason there isn't one.

Listen for: two independent failures. Purpose — consent scoped the data to fraud prevention, and training a marketing model is a new purpose that consent never covered (purpose limitation). Time — the retention window closed, so there was no lawful basis to hold the data at all when it was reused. Either one is a finding; together they mean the data should have been deleted before it was ever queried for marketing.
Weak signal: "we had consent, they clicked accept." Consent is scoped and time-boxed; a click years ago for one purpose is not a standing license for every future purpose. Reading consent as unbounded is exactly the interpretation regulators reject.

The data was three years old and reused for a new purpose. Which control should have caught it, and when?

Listen for: the reuse should have failed at training time, not at audit time — a data-use policy check in the pipeline that asks "does this dataset's consented purpose match this model's purpose, and is it still within its retention window?" and fails the build if not. And the stale records should have been gone already: an expiry job that deletes or quarantines at the twenty-four-month mark means there is nothing left to reuse.
Weak signal: "the analyst should have known better" or "legal should review campaigns." Both put the control in a human's memory — the same place it already lived when it failed. The question is what in the platform says no.

What has to be recorded, at collection time, for anyone to answer the regulator in an afternoon?

Listen for: a consent registry that stores, per record or per cohort, the purpose scope it was collected under, the consent version, and the expiry date — plus purpose tags on the data itself that travel through lineage into every derived table and feature. Without those, "what may this data be used for, and until when?" is unanswerable, which is itself the finding.
Weak signal: "it's in the privacy policy" or "the DPA covers it." A policy document is not a queryable control; if you can't join a training dataset back to a purpose and an expiry date, you cannot prove a lawful basis, and unprovable is indistinguishable from absent.

The reveal

There is no lawful basis, and the team cannot manufacture one after the fact. The consent said fraud; the use was marketing; and the retention clock had already run out, so a large share of the training data should have been deleted before the marketing model ever saw it. The examination widens from "was this campaign compliant?" to "what else in the warehouse is being used past its purpose or past its expiry?" — and nobody can answer, because the platform records neither purpose nor expiry in any form a query can read. The model gets pulled, the campaign is unwound, and the remediation is a warehouse-wide reconstruction of collection context that was cheap to capture at ingestion and enormously expensive to rebuild years later.

Why this happens — the mechanics

Consent is a scoped, time-boxed contract, and standard data infrastructure preserves neither dimension. An ETL (Extract, Transform, Load) job carries types, values, and schemas — the properties queries need — and strips the legal context, because no column type exists for "collected under fraud-consent notice v3, retain until 2022-06." The purpose scope evaporates the moment the data lands in a shared table, and the expiry date was never a field in the first place; it lived in a retention schedule in a policy document, enforced by nobody. So the two facts that define the lawful basis — what for and until when — are exactly the two the platform forgets first.

That forgetting inverts the cost curve, which is this whole theme's signature. At collection time, recording purpose and expiry is a tag and a date — minutes of work by the people who know the answer. Years later, reconstructing them means reverse-engineering the collection context of every table from ingestion logs and old consent notices, under a regulator's clock. Nothing enforces the cheap moment, because the data scores fraud identically whether or not its purpose and expiry were ever written down — the deadline that would force the work never arrives until an examiner invents one, at the expensive end.

And reuse is the path of least resistance. Doing the compliant thing — noticing that marketing is a new purpose, checking whether the data is still in its retention window, triggering a fresh consent — takes legal knowledge and friction. Doing the violating thing takes ten minutes of SQL against a table you can already read, and produces a model that lifts conversion. When the platform expresses no purpose boundary and no expiry, every incentive points across the line, and each quiet reuse normalizes the next. The expired consent didn't fail loudly on any single day; it was never tracked, so there was no day on which it could fail — until someone finally looked.

Diagrams

Problem — how the failure unfolds:

timeline
    title A consent that lapsed, then got reused
    section Collection
        2019 : Fraud data collected : Consent - fraud only, keep 24 months
    section Silent decay
        2019-2021 : Data scores transactions for fraud
        2021 : Retention window closes (silent) : Records should expire - nobody tracks the clock (silent)
        2022 : Marketing team finds the fraud tables (silent) : Trains a next-best-offer model on it (silent)
        2023 : Campaign ships - conversion lifts
    section Discovery
        2024 : Regulator asks for the lawful basis : None exists - wrong purpose and expired
        2024-2025 : Warehouse-wide remediation : Reconstruct purpose and expiry after the fact

Solution — where the guardrails go:

flowchart TD
    A["Fraud data collected<br/>(purpose scope + expiry<br/>recorded at ingest)"] --> R["Consent registry<br/>(purpose, consent version,<br/>expiry date per record)"]
    R --> T["Purpose tag travels with<br/>the data through lineage"]
    T --> P["Training pipeline requests<br/>fraud data for a<br/>marketing model"]
    P --> G["Data-use policy check<br/>(purpose match AND<br/>expiry not passed)"]
    G -->|"mismatch or expired"| D["Build fails closed<br/>(no lawful basis, no<br/>training run)"]
    R -.-> RF["Consent-refresh job<br/>(re-consent 60 days<br/>before expiry)"]
    T -.-> M["Purpose and expiry monitor<br/>on query and training logs"]
    M -.-> AL["Off-purpose or expired<br/>use flagged within one day"]

What good looks like

A consent registry with purpose and expiry: every consent record (or cohort) stores its purpose scope (purpose=fraud_prevention), consent-notice version, and an explicit expiry date derived from the retention schedule. A nightly job flags records within 60 days of expiry and blocks any read against a record already past it — the join table between legal language and platform metadata, owned jointly by privacy and data engineering.
Purpose tags enforced at query and training time: tags applied at ingestion and inherited by every derived table and feature through lineage; the feature store and training loader refuse any dataset whose purpose tag does not match the declared model purpose. An untagged derived dataset fails the pipeline rather than defaulting to "allowed."
A periodic consent-refresh workflow: a scheduled job triggers re-consent 60 days before a record's expiry; records that aren't refreshed by the expiry date are auto-quarantined and then deleted, so stale data cannot survive to be reused. Default retention is set per data class (e.g., 24 months for fraud signals), never open-ended.
A data-use policy check in the pipeline: a pre-training gate (a required CI step) that passes only if purpose matches AND expiry has not passed AND consent version is current — and fails the build, fail-closed, otherwise. The model cannot train on data it has no lawful basis to use, and the gate's log is the lawful-basis evidence for that model.
A purpose-and-expiry monitor as the detective backstop: a daily scan of query and training logs comparing each job's declared purpose and each dataset's expiry against the registry, flagging off-purpose or expired access within one day — the control that catches whatever the preventive gates miss.
A lawful-basis register per production model: every deployed model maps to a documented lawful basis (which data, which consented purpose, which expiry) reproducible in an afternoon; a quarterly rehearsal picks a random model and tries to produce it, and every gap found in the drill is a finding not received in the exam.

The lesson

Consent is a scoped, time-boxed contract, and a lawful basis has to be provable at the moment of use — which means the platform must record two things collection-time infrastructure throws away first: what the data was collected for, and until when. Store purpose and expiry as queryable metadata, tag the data so both travel through lineage, and put a fail-closed policy check between the data and any new use. If you can't join a model's training set back to a consented purpose and an unexpired basis, you don't have consent — you have a finding waiting for someone to look.

Named concepts: lawful basis, consent expiry, purpose limitation, data-use governance.

Real-world echoes

The UK ICO's 2020 enforcement action against Experian. The Information Commissioner's Office found that Experian was processing personal data obtained for credit-referencing purposes and repurposing it for direct marketing without adequately informing the people concerned or securing an appropriate lawful basis. Different furniture — credit-reference data rather than fraud signals — but the same failure shape: data collected under one purpose flowing into another through infrastructure that recorded no boundary, and a regulator asking for a lawful basis that turned out not to exist.

Transfer

Pick the richest dataset your models train on and answer three questions in writing: what purpose was it collected under, where is that recorded, and when does the lawful basis to hold it expire? If any answer lives in a policy document rather than a queryable field, a model somewhere is already training on data it may have no basis to use.

Make it a ticket: add a purpose tag and an expiry date to your most sensitive training source in the catalog this sprint, and wire one pre-training gate that fails the build when a model's declared purpose doesn't match the data's tag or the data is past expiry. One source, one gate; the pattern scales from there.

Drill 53 — Purpose Creep — the sibling failure of authorized-but-off-purpose reuse; this drill adds the second dimension, an expiry the platform never tracked.
Drill 51 — The Bucket Named archive-temp-final2 — retention and expiry as the tag that dies in migrations; data held long past its lawful window, seen from the storage side.
Drill 52 — The Proxy Variable — another "technically permitted, legally wrong" reuse, where the boundary the platform couldn't express was fairness rather than purpose.