The Harbour Master’s Ledger: How Purpose Limitation Became the Binding Constraint on Model Training

The Ledger That Changed Hands

A harbour master who recorded every vessel's manifest to prevent collisions did nothing unlawful; the harm began the day he began selling those manifests to underwriters and rivals. Nothing was stolen. The purpose simply changed, and with it the relationship between the recorder and the recorded. European data protection law treats that shift as the central injury, and it is precisely where the training of large generative models now sits under pressure.

Supervisory authorities have moved from advisory posture to enforcement posture on the lawful basis for training models on personal data, asserting that legitimate interest cannot be presumed for indiscriminate collection and that opt-out mechanisms offered after the fact do not cure a defect in purpose. The consequence is structural rather than punitive: a material share of existing training corpora now carries an unresolved provenance defect that no amount of post-hoc filtering reliably repairs.

The Credit Bureau Precedent

The nearest historical analogue is not a surveillance case at all, but the nineteenth-century merchant ledger. Traders recorded transactions to settle debts; bureaus later aggregated those records into reputational scores that determined who could borrow, rent, or be hired. The records were lawfully created. Their repurposing was not. The American response, the Fair Credit Reporting Act of 1970, did not prohibit collection. It imposed purpose limitation, accuracy obligations, and a dispute mechanism, converting an opaque administrative practice into an auditable one. The lesson for machine learning is uncomfortable: regulators rarely ban data use. They build the machinery of contestation, and they build it after the harm becomes legible to the public rather than to the specialists who predicted it.

Three Vectors the Coverage Ignores

First, deletion has become an engineering liability without an audit standard. A deletion request issued against a dataset is trivial; the same request issued against a trained parameter set is an open research problem. Carlini and colleagues demonstrated at USENIX Security in 2021 that large models memorize and can emit training sequences verbatim, and that membership inference succeeds with meaningful confidence against models never designed to leak. The paper is the reason a deletion attestation for a foundation model is not presently a deliverable, and it is the reason counsel will spend the next two years drafting contractual language for a control that does not exist.

Second, enforcement migrates from the courtroom to procurement. When a lawful basis cannot be presumed, the burden shifts into vendor management: indemnities, audit rights, per-dataset provenance schedules, and flow-down obligations onto aggregators and scrapers. Privacy ceases to be a legal opinion and becomes a supply-chain specification. Boards that still treat this as a policy matter will discover that their model vendors cannot warrant what they cannot measure, and that the warranty was the only asset the board believed it had purchased.

Third, the burden falls asymmetrically, and in a direction that favours opacity. Deployers with revenue, employees, and brand exposure are legible to regulators. Open-weight releases, academic corpora, and non-commercial research are not. The predictable result is a market in which the most auditable systems are the most constrained, and the least auditable are the least burdened. That is not a stable equilibrium; it is an arbitrage waiting for the next breach to expose it.

Two Places the Argument Is Too Neat

The claim that every scraped corpus is therefore unlawful rests on an overstated premise. Genuinely anonymous data falls outside the scope of data protection law entirely, and statistical disclosure control, aggressive aggregation, and synthetic generation can sever identifiability in ways that are technically defensible and legally operative. Treating anonymity as a binary rather than a continuum, however, cuts against the industry as well: re-identification against sparse, high-dimensional records is well documented, and a corpus that is anonymous at publication may not remain so once it is combined with the model's own outputs. The honest position is that anonymity is a managed risk with a depreciation schedule, not a certificate.

The second weakness is economic rather than doctrinal. A strict reading that forecloses legitimate interest does not distribute protection evenly; it rewards whoever can license text at scale. Incumbents with balance sheets can buy the provenance that regulators demand. Universities, independent labs, and small deployers cannot, and the competitive effect is to consolidate capability in exactly the entities least in need of supervision. A proportionality-based regime, with opt-out available before collection and auditable safeguards, would protect the interest the enforcement theory claims to serve while leaving the research commons intact. The current trajectory risks being simultaneously over-inclusive of benign research and under-inclusive of the opaque releases that matter most.

Guidance on the interplay between data protection rules and the development of generative artificial intelligence models is available to controllers and processors.

— European Data Protection Board (@EDPB_news) official guidelines

What Counsel and Procurement Should Do This Quarter

Segregate licensed corpora from scraped ones at the storage layer, not in documentation. A deletion order that can be executed against an isolated partition is a cost; a deletion order that requires retraining a blended corpus is an event. Codify purpose codes in the data map so that every downstream use can be traced to an asserted basis, and gate every training run behind a documented assessment rather than a quarterly review. Insist on audit rights and indemnities in data licences, and price the absence of provenance as a liability rather than a discount. Citizens benefit from the same discipline in miniature: the right that functions is the right to correct and to contest, not the right to be informed.

Six Months Out

Expect provenance to harden into a procurement clause with service-level consequences, and a two-tier market to crystallise: licensed-corpora models carrying premium pricing and insurable warranties, and unverified open-weight models that regulated industries simply cannot underwrite. Underwriters will begin pricing the provenance defect into technology errors and omissions cover, which is the mechanism that will do more to discipline training practice than any fine. The harbour master's ledger is not being confiscated. It is being audited, and the audit is the product.