Ang Scenario: Customer Support Data Flowing into AI

Ang typical customer support workflow:

Customer writes: "Hi, my name is John Smith, customer ID is CUST-12345, my email is john@example.com"
Support agent pastes sa AI chatbot: "How do I help this customer?"
AI chatbot ay nag-analyze ng full message including PII
AI model ay nag-train sa PII data

Result: GDPR violation - personal data processed without consent

Ang Problem: AI Models Trained on Customer Data

Ang major AI providers (OpenAI, Anthropic, etc.) ay may data retention policies:

ChatGPT: 30-day retention ng chat history
Claude: 30-day retention ng API calls
Custom models: Indefinite training data retention

Pero ang GDPR ay nag-require:

Article 5(1): Data minimization - mag-collect lang ng data na kailangan
Article 17: Right to deletion - dapat ma-delete ang customer data upon request
Article 32: Security - encrypted transmission

Kung ang customer ID, email, phone ay nag-flow through AI, ang organization ay nag-breach ng Article 5.

Ang Solution: Custom Entity Recognizer para sa Support Identifiers

Ang anonym.legal ay nag-offer ng in-context custom recognizers:

Hakbang 1: Define Support-Specific Entities

{
  "support_entities": {
    "CUSTOMER_ID": {
      "patterns": [
        {"regex": "CUST-\d{5}", "confidence": 0.95},
        {"regex": "Customer ID: [A-Z0-9-]+", "confidence": 0.90}
      ]
    },
    "TICKET_NUMBER": {
      "patterns": [
        {"regex": "TKT-\d{8}", "confidence": 0.95},
        {"regex": "#\d{6}", "confidence": 0.85}
      ]
    },
    "SUPPORT_AGENT_ID": {
      "patterns": [
        {"regex": "Agent [A-Z]{3}\d{3}", "confidence": 0.90}
      ]
    },
    "ORDER_REFERENCE": {
      "patterns": [
        {"regex": "ORD-\d{10}", "confidence": 0.95}
      ]
    }
  }
}

Hakbang 2: Implement In-Context Recognition

from presidio_analyzer import AnalyzerEngine, PatternRecognizer, Pattern

analyzer = AnalyzerEngine()

# Customer ID recognizer
cust_id = PatternRecognizer(
    supported_entity="CUSTOMER_ID",
    patterns=[
        Pattern(name="cust_format", regex=r"CUST-\d{5}"),
        Pattern(name="cust_context", regex=r"Customer ID: [A-Z0-9-]+")
    ],
    context=["customer", "ID", "account"]
)

# Ticket number recognizer
ticket = PatternRecognizer(
    supported_entity="TICKET_NUMBER",
    patterns=[
        Pattern(name="ticket_format", regex=r"TKT-\d{8}"),
        Pattern(name="ticket_hash", regex=r"#\d{6}")
    ],
    context=["ticket", "issue", "support"]
)

analyzer.registry.add_recognizer(cust_id)
analyzer.registry.add_recognizer(ticket)

# Test
customer_message = """
Hello, I have an issue with my account.
Customer ID: CUST-45678
Email: john@example.com
Ticket: TKT-20250308-001
"""

results = analyzer.analyze(
    text=customer_message,
    entities=["CUSTOMER_ID", "TICKET_NUMBER", "EMAIL_ADDRESS"]
)
print(results)

Hakbang 3: Anonymize Bago I-Send sa AI

from presidio_anonymizer import AnonymizerEngine

anonymizer = AnonymizerEngine()

# Before sending to AI:
anonymized_message = anonymizer.anonymize(
    text=customer_message,
    analyzer_results=results,
    operators={
        "CUSTOMER_ID": OperatorConfig("replace", {"new_value": "<CUSTOMER_ID>"}),
        "TICKET_NUMBER": OperatorConfig("replace", {"new_value": "<TICKET>"}),
        "EMAIL_ADDRESS": OperatorConfig("replace", {"new_value": "<EMAIL>"})
    }
)

print(anonymized_message)
# """
# Hello, I have an issue with my account.
# Customer ID: <CUSTOMER_ID>
# Email: <EMAIL>
# Ticket: <TICKET>
# """

# Now safe to send to AI chatbot
ai_response = send_to_ai(anonymized_message)

Ang Workflow Architecture

[Customer Support Agent Input]
        ↓
[Custom Entity Detection]
  - Detect CUSTOMER_ID
  - Detect TICKET_NUMBER
  - Detect EMAIL_ADDRESS
        ↓
[Anonymization]
  - Replace with placeholders
        ↓
[AI Chatbot Processing]
  - Process anonymized message
        ↓
[De-reference (Optional)]
  - If AI needs context, fetch from secured database using CUSTOMER_ID
        ↓
[Response to Agent]

Requirement	Without Anonymization	With Anonymization
Article 5 (Data Minimization)	❌ Full data to AI	✅ Only placeholders
Article 17 (Right to Delete)	❌ Can't delete from AI	✅ Only ID, not AI model
Article 32 (Security)	❌ PII in transit	✅ Encrypted only
Compliance Evidence	❌ None	✅ Audit log of anonymization

Real-World Case: Zendesk Support Implementation

Isang SaaS company ay nag-integrate ng ChatGPT para sa customer support suggestions:

Before Anonymization:

[Support Ticket in Zendesk]
Customer: John Smith
Email: john@example.com
Customer ID: CUST-45678
Issue: Billing question

[AI Chatbot]
← Raw customer data goes to ChatGPT API
→ ChatGPT trains on customer PII
RESULT: GDPR violation

After Anonymization:

[Support Ticket in Zendesk]
Customer: <PERSON>
Email: <EMAIL>
Customer ID: <CUSTOMER_ID>
Issue: Billing question

[AI Chatbot]
← Anonymized data goes to ChatGPT API
→ ChatGPT cannot identify customer
RESULT: GDPR compliant

Ang Best Practice

Define custom entities para sa support identifiers (customer ID, ticket, order ref)
Implement pre-AI anonymization - remove PII bago mag-send sa chatbot
Log anonymization events - track para sa GDPR audit
De-reference only from secured database - hindi from AI response

Ang customer support + AI anonymization ay essential para sa GDPR compliance habang gumagamit ng AI tools.