Information about companies often includes the names of real people, such as owners or directors. In the European Union, such information is protected by data protection law (the GDPR). Under what conditions should a company be allowed to use this kind of information to train and run an AI system, and for how long should it be kept?