A team proposes using private support conversations for model training. Which action should come before collecting and processing them?

1. Publish the raw conversations to demonstrate transparency.
2. Assume that access to the production database grants unlimited reuse rights.
3. Remove the privacy notice so users cannot object.
4. Establish an appropriate lawful basis, permissions, purpose, and data-minimization controls.