Data Minimization

The three-limbed statutory test for data minimization. Each data point collected must satisfy all three criteria simultaneously.

• Adequacy: Is the data sufficient to properly fulfill the stated purpose? Insufficient data leads to inaccurate models.
• Relevance: Does the data have a rational link to the purpose? Collecting geo-location for a static document storage service fails this test.
• Necessity: Is there no less intrusive means? If a statistical model works with aggregated data, raw individual records are unnecessary.

Minimization extends beyond collection to storage limitation. Data must be kept in an identifiable form for no longer than necessary.

• Automated TTLs: Implementing Time-To-Live policies that automatically anonymize or purge records after a defined period.
• Rolling Windows: In streaming AI architectures, training windows slide forward, discarding stale data to maintain relevance and compliance.
• Anonymization vs. Deletion: True anonymization (irreversible) is a valid alternative to deletion, allowing long-term statistical analysis without retaining personal data.

A technical strategy to derive insights without holding granular personal data. By raising the level of abstraction, the data ceases to be personal.

• K-Anonymity: Ensuring data is indistinguishable from at least k-1 other individuals in the dataset.
• Differential Privacy: Injecting mathematical noise into query results to mask the presence of any single individual.
• On-Device Processing: Performing computations locally (e.g., federated learning) so raw data never leaves the user's device, only model updates.

A design pattern where data is requested at the exact moment it is needed for a specific transaction, rather than hoarding it upfront.

• Progressive Profiling: Asking for a user's role only when they attempt an admin function, not during account creation.
• Contextual Integrity: Respecting that data shared in one context (e.g., a doctor's appointment) should not flow into another (e.g., targeted advertising).
• Ephemeral Processing: Data is held in volatile memory, processed, and immediately discarded without ever being written to persistent storage.

Replacing real personal data with high-fidelity artificial data for AI training and testing, preserving statistical utility while eliminating privacy risk.

• Generative Models: Using GANs or diffusion models to create synthetic datasets that mimic real distributions.
• Utility vs. Fidelity: A critical trade-off; high-fidelity synthetic data may inadvertently memorize rare real records.
• Regulatory Acceptance: Regulators increasingly view robust synthetic data as a valid minimization technique, removing the dataset from the scope of data protection law.