Want to know the best-kept "secret" in #cybersecurity for avoiding a potential #databreach or putting #customerdata in harm's way? Every experienced #CIO and #CISO already knows it by heart because it's super simple: "Don't collect unnecessary data in the first place!"
Even if a product actually needs the data for legitimate reasons from the customers' point of view, they should still be informed of the alleged necessity first, and then asked for permission to collect and use the data. That ensures that customers have the opportunity to evaluate the sensitivity of the data involved, and determine for themselves what the the potential risks and rewards of sharing it might be. Collecting the data first and then expecting customers to believe that a vendor can or will honor a future opt-out request is just silly, especially in the modern age of giant data lakes, massive online redundancy, 100+ year shelf-lives for petabytes of off-site storage media, and sub-sub-sub data processors.
This is an extremely tone-deaf approach by #Salesforce to the current regulatory issues around mass data collection whether or not it's #AI_ML related. It is also unlikely that this policy complies with EU #privacyregulations or #AIgovernance laws. I'm neither a lawyer nor a party to any associated DPAs or NDAs related to this particular service, but if you're responsible for vendor selection, #regulatorycompliance, or #dataprivacy at your organization you need to go screenshot this before Salesforce tries to walk it back and pretend it never happened—leaving you holding the bag when your customers' data is inevitably exposed, of course.
https://help.salesforce.com/s/articleView?id=000384050&type=1