Lesson 8.2 | Data Minimization, De-Identification, Memory, and Retention

1. Lesson Overview

In Lesson 8.1, you learned to classify information and assess authority and purpose. Now you will go further: what is the minimum information actually necessary for your AI-supported task? This lesson introduces data minimization as a core privacy and security principle. You will learn to distinguish de-identification techniques—deletion, redaction, masking, pseudonymisation, anonymisation, aggregation, and synthetic substitution—and understand why removing names does not guarantee anonymity. You will also examine re-identification and inference risks, and assess conversation history, persistent memory, retention, secondary use, and deletion across the AI lifecycle.

By the end, you will be able to redesign prompts and workflows to use synthetic, generalized, or aggregated information while preserving the task’s legitimate purpose. These skills are essential for responsible AI use and directly inform your work in Lessons 8.3–8.4 and Assignment 3.

Privacy and security reminder: This lesson uses only synthetic, public, or generalized information. Do not enter real personal, confidential, proprietary, privileged, security-sensitive, or culturally governed information into any AI system unless you have verified authority and the system is approved for that use. If you are unsure, stop and consult your course coordinator or institutional privacy office.

2. Learning Outcomes

By the end of this lesson, you should be able to:

Apply data minimization to a prompt, context package, or workflow.
Distinguish deletion, suppression, redaction, masking, pseudonymisation, anonymisation, aggregation, and synthetic substitution.
Explain why removing names may not prevent re-identification.
Recognize direct, indirect, and combined identifiers.
Identify inference risks from apparently non-sensitive information.
Assess risks associated with conversation history, persistent memory, retention, logging, reuse, and secondary use.
Explain why user-visible deletion may not prove complete deletion from all systems.
Identify privacy-preserving alternatives, including synthetic, generalized, aggregated, or locally processed information.
Redesign a prompt using synthetic or generalized information.

3. Before You Begin

Assigned reading: Chapter 10: Privacy, Security, and Data Protection (sections on data minimization, de-identification, retention, and memory).
Prerequisite knowledge: Lesson 8.1 (classification, authority, purpose limitation). Familiarity with FAIRER, ORBIT, and SCOPE from Units 3–7.
Optional approved AI tool: If you have access to an institutionally approved AI system, you may use it with synthetic, public, or generalized information only. Do not enter real or sensitive information.
Supplied-output alternative: All activities include supplied prompts and synthetic records—no live system required.
Information-protection reminder: Use only synthetic, public, or generalized data. No real personal, confidential, proprietary, privileged, security-sensitive, or culturally governed information may be used.
Academic integrity: All work must be your own. When you use AI tools, document your use according to your institution’s policy.
Accessibility: All activities are available in text; diagrams are described; all answers are in expandable details elements.
Estimated preparation time: 20–30 minutes.

4. Retrieval Practice: Concepts from Lesson 8.1

These questions draw on Lesson 8.1 and earlier units. Try to answer before expanding the feedback.

Question 1: In Lesson 8.1, you learned that access does not equal authority. Give a brief example of a situation where you have access to information but lack authority to use it in an AI system.

Show answer

Example: You are a teaching assistant with access to student grades in the learning management system. You have access for administrative purposes (e.g., entering grades), but you do not have authority to copy those grades into a public AI system for analysis—that would be a new purpose requiring explicit permission.

Question 2: What is the difference between purpose limitation and data minimization? (Hint: one is about why you use information, the other about how much you use.)

Show answer

Purpose limitation restricts the use of information to the authorised purpose. Data minimization restricts the quantity of information to what is necessary for that purpose. Both are complementary: you first define the purpose, then minimize the data to only what is needed.

Question 3: From Unit 6, why is it important to distinguish human authority from AI capability when assessing information use?

Show answer

Because an AI system may be capable of processing vast amounts of information, but it has no authority to decide what is permissible. Human authority must govern what information is supplied, for what purpose, and with what safeguards. Minimization, de-identification, and retention decisions are human responsibilities.

5. Opening Scenario: "The Research Interview"

📌 Scenario — The Research Interview

Context: You are a graduate student conducting a qualitative study on “experiences of remote work during the pandemic.” You have conducted 15 semi-structured interviews. You have transcribed them verbatim. The transcripts include:

Participant names (which you plan to remove).
Exact dates of interviews.
Job titles, department names, and company sizes.
Specific locations (city, neighbourhood).
Detailed personal stories about health, family, and financial challenges.
Uncommon events (e.g., “my company had a layoff in March 2020”).

You want to use a public AI system to identify common themes across the transcripts. You will remove the participants’ names before uploading.

Questions to consider:

Could the participants still be identifiable even after names are removed?
What details are actually necessary for your theme analysis?
What safer substitutes exist for the information you need?
What retention and memory questions should you ask about the AI system?

Show guided analysis

1. Identifiability: Yes. Even without names, the combination of exact dates, job titles, department, location, and unusual events (e.g., layoff) can easily identify individuals, especially in a small sample (15 participants). This is a classic re-identification risk.

2. Necessity: For theme identification, you likely do not need exact dates, specific company names, or exact locations. You may need job roles and general industry, but not specifics that narrow it down to a single person.

3. Safer substitutes: Use generalised values: “early 2020” instead of “March 15, 2020”; “technology sector” instead of the exact company; “large city” instead of the exact city. You could also synthesise quotes that capture the theme without using the original wording. Or use aggregated summaries of themes rather than full transcripts.

4. Retention and memory: You must check whether the AI system retains your input (conversation history, memory, training). If it retains the transcripts, you have effectively shared the information permanently. Even if the system claims to delete after a session, you need to verify. If you cannot confirm, it is safer not to upload.

6. Data Minimization

Definition — Data Minimization

Data minimization is the principle that you should use only the minimum amount of information necessary to achieve your legitimate purpose. It reduces privacy risk, security exposure, and the impact of potential breaches.

Minimization can involve:

Omitting unnecessary fields (e.g., leaving out names if not needed).
Generalizing details (e.g., “30–40 years old” instead of exact age).
Using categories instead of precise values (e.g., “healthcare sector” instead of a specific hospital).
Substituting synthetic examples (e.g., creating fictional but representative quotes).
Aggregating data (e.g., averages or totals instead of individual records).
Processing locally on your device rather than uploading.
Separating tasks to reduce the scope of information needed for each step.
Restricting access to only those who need it.
Shortening retention periods.

Important: Minimization must not remove information needed for fairness, verification, safety, accessibility, or lawful review. For example, if you are analyzing bias, you may need demographic data—but you may be able to use it in aggregated form or with pseudonyms.

🧩 Application: Minimise the interview transcripts

In the opening scenario, what fields could you omit or generalize?

Show sample

Omit: participant names, exact dates (use “Spring 2020”), exact company names (use “a mid-sized tech firm”), exact city (use “urban centre”).
Generalize: job titles (e.g., “manager” instead of “Senior Product Manager at X Corp”).
Use synthetic: replace direct quotes with paraphrased or synthetic quotes that capture the theme.
Aggregate: instead of individual stories, create theme summaries.

Section summary

Data minimization means using only what is necessary.
Minimization can be achieved through omission, generalization, aggregation, synthetic substitution, and local processing.
Minimization must not remove information needed for fairness, verification, or lawful review.

7. De-Identification Methods

De-identification is the process of removing or altering identifying information. It exists on a spectrum. The table below defines the key methods.

Table 1. De-identification methods compared
Method	Definition	Re-identification risk
Deletion	Removing information from a particular location or record.	No risk for that location, but other copies may exist.
Redaction	Removing or obscuring selected information from a document (e.g., blacking out names).	Moderate—other parts may still identify.
Masking	Replacing information with altered or hidden values (e.g., “***” for a name).	Depends on the masking scheme; may still be reversible.
Pseudonymization	Replacing direct identifiers with codes while retaining a means of reconnection (e.g., a lookup table).	High if the mapping is accessible.
Anonymization	Transforming information so that people are not reasonably identifiable under the applicable context and standard.	Low, but not guaranteed—re-identification may still be possible with auxiliary data.
Aggregation	Combining information into groups or summaries (e.g., averages).	Low if group sizes are large; small groups can still allow inference.
Synthetic substitution	Using invented but representative information rather than real records.	Very low—no real data is used.

Critical: De-identification effectiveness depends on context and the availability of auxiliary information. Removing names is rarely sufficient—indirect identifiers can enable re-identification.

Section summary

De-identification is a spectrum, not a binary.
Pseudonymization retains a re-identification pathway; anonymization aims to remove it.
Aggregation and synthetic substitution reduce risk but depend on group size and representation.

8. Direct, Indirect, and Inference Risks

Direct identifiers uniquely identify a person: name, ID number, account number, exact contact info, recognizable image.

Indirect identifiers can be combined to identify a person: location, age, position, dates, uncommon events, small-group membership, institutional affiliation, distinctive history.

Inference risk occurs when an AI system or user derives sensitive information from apparently non-sensitive data. For example, from a person’s purchase history, you might infer health conditions.

Example: A dataset contains age, gender, zip code, and a rare medical condition. Even without names, the combination may identify a specific individual if the zip code is small. This is a re-identification risk.

Common misconception: “I removed names, so the data is anonymous.” No. Anonymization requires more—often statistical guarantees that re-identification is not reasonably possible. Removing names is just one step.

Section summary

Direct identifiers uniquely identify a person.
Indirect identifiers can be combined to re-identify.
Inference risk arises when non-sensitive data can reveal sensitive facts.
Removing names is insufficient for anonymization.

9. Conversation History, Persistent Memory, and Retention

When you interact with an AI system, your inputs may be stored in multiple places:

Current prompt: The immediate request.
Conversation history: Earlier messages in the same session—may persist across the session.
Persistent memory: Information stored across sessions (e.g., preferences, user-provided context).
System logs: Operational records of interactions—may be retained for monitoring or improvement.
Retrieved records: Information accessed from external repositories (e.g., uploaded files).

Retention concerns what is stored, where, for how long, for what purpose, who can access it, whether it is reused, and how deletion works.

Critical: User-visible deletion (e.g., deleting a chat) does not guarantee complete deletion from all systems. Backups, logs, and training data may still contain your information. Always verify the system’s data-deletion policies and practices.

Always check the AI provider’s documentation to understand their memory and retention practices. Do not assume; verify.

Section summary

Your inputs may be stored in multiple places, from active prompts to persistent memory and logs.
Retention has multiple dimensions: what, where, how long, for what purpose, and who can access.
User-visible deletion is not the same as complete deletion.

10. Secondary Use and Deletion

Secondary use is using information for a purpose beyond the original authorised purpose. Examples: model training, analytics, research, profiling, advertising, reuse in another project. Secondary use is not automatically permitted—it requires a new purpose-limitation assessment.

Deletion must be confirmed across all locations: the active system, backups, logs, and any copies made. You should ask:

Who can request deletion?
How long does it take?
Is deletion irreversible?
Are there records of deletion?

🧩 Application: Identify secondary uses

In the opening scenario, if you upload transcripts to a public AI system, you are enabling secondary use (the provider may use your data for training or analytics). You must check the terms of service. If secondary use is not permitted or unclear, you should not upload.

Section summary

Secondary use is a new purpose requiring new authority.
Deletion must be confirmed across all locations.
When secondary use is unclear or not permitted, do not upload.

11. PROTECT Walkthrough — Controls

PROTECT is the author-approved framework for privacy, security, and responsible information governance. This lesson introduces the elements related to Controls (C)—specifically data minimization, de-identification, and retention controls. The exact expansion of PROTECT will be supplied from Chapter 10; placeholders are used below.

Figure 1 (placeholder): [INSERT AUTHOR-APPROVED PROTECT EXPANSION AND DIAGRAM — CONTROLS SECTION] — The PROTECT framework, highlighting controls for minimization, de-identification, memory, and retention.

PROTECT Element: C — Controls (Minimization & De-identification)

Definition: [INSERT DEFINITION FROM CHAPTER 10 — CONTROLS FOR MINIMIZATION AND DE-IDENTIFICATION]

Guiding questions: What is the minimum information needed? Have we removed or generalized identifiers? What de-identification method is appropriate? What retention period is necessary?
Example: In a survey analysis, you replace exact ages with age ranges and use random participant IDs instead of names.
Common mistake: Believing that removing names is sufficient anonymization.
Control: Apply a minimization checklist to every prompt and workflow.
Escalation/stop condition: If you cannot minimize to a safe level, stop and seek alternatives (e.g., synthetic data, non-AI methods).
Residual limitation: Even with minimization, risk may remain if the AI system retains or reuses the data.

PROTECT Element: C — Controls (Retention & Deletion)

Definition: [INSERT DEFINITION FROM CHAPTER 10 — RETENTION AND DELETION CONTROLS]

Guiding questions: How long is information stored? Where? Who can access it? Is it used for secondary purposes? How is deletion confirmed?
Example: A university deletes student survey data after 5 years, and confirms deletion through logs and audit.
Common mistake: Assuming that deleting a chat removes all copies.
Control: Implement a retention schedule and a deletion-verification process.
Escalation/stop condition: If retention or deletion cannot be verified, stop using the system for that information.
Residual limitation: Even with a policy, human error or system failures can cause unintended retention.

Note: The exact PROTECT element names and expansions will be inserted when confirmed from Chapter 10. The above operational definitions align with the lesson’s learning outcomes.

12. Process Walkthrough: From Full Data to Minimized, Privacy-Preserving Input

This walkthrough shows how to transform a rich dataset into a minimized, privacy-preserving prompt for an AI system.

Define the task. What do you actually need from the AI?
List all information fields in your original data.
For each field, ask: Is this essential for the task? Could it be omitted, generalized, or replaced?
Identify direct identifiers (names, IDs, etc.) and remove or pseudonymize them.
Identify indirect identifiers (dates, locations, rare attributes) and generalize or aggregate.
Consider inference risk — could the remaining information still reveal sensitive details?
Choose a de-identification method: redaction, pseudonymization, anonymization, aggregation, or synthetic substitution.
Check if the AI system will store or retain your input (memory, history, training). If yes, what is the retention period? Can you delete it?
Consider secondary use — will the provider use your data for other purposes? If so, is that acceptable?
Produce the minimized prompt using only the transformed information.
Document your minimization decisions — this is evidence of responsible use.
If in doubt, stop and choose a non-AI alternative or seek specialist review.

🧩 Application: Apply the process to the research interviews

Apply this process to the opening scenario. Which steps would you take?

Show sample walkthrough

Task: Identify common themes in interview transcripts.

Fields: name (omit), exact dates (generalize to “2020–2021”), job titles (generalize to “manager” or “professional”), company (generalize to “tech firm”), location (generalize to “urban”), stories (replace with synthetic or paraphrased quotes).

Direct identifiers: names removed.

Indirect identifiers: dates, job, location, company—all generalized.

Inference risk: Even generalized, the combination of a specific industry and a rare event (e.g., layoff) might still identify a person. If so, you may need to further aggregate or use synthetic examples.

Method: Use synthetic substitution for quotes and aggregate themes.

Retention: Check the AI system’s policy—if it retains input, do not upload; use a local or approved system.

Secondary use: If the system uses data for training, you must not proceed.

Final prompt: Use a description of the themes and a few synthetic quotes that illustrate each theme, without any real identifiers.

13. Worked Example: Analysing Student Feedback

Context: A university department wants to use an AI system to analyse open-ended student feedback from course evaluations. The feedback includes comments like: “Professor Smith’s lectures were excellent, but the assignments were too heavy for a 3-credit course.”

Original data: 500 comments, each with student name (removed), student ID (removed), course code, term, and comment text.

Task: Identify common themes (e.g., workload, teaching quality, assessment).

Minimization Steps

Omit: student names and IDs—not needed.
Generalize: course code to discipline (e.g., “COMP” instead of “COMP 327”).
Generalize: term to academic year (e.g., “2024–2025” instead of “Fall 2024”).
Redact: any specific instructor names (e.g., replace “Professor Smith” with “the instructor”).
Aggregate: Instead of using individual comments, group them by theme and use counts or percentages.
Synthetic substitution: Create a set of synthetic comments that illustrate each theme without using real text.

Resulting prompt: “I have a set of student comments about a course. The comments have been anonymized and aggregated. Please identify the top 3 themes and give a brief description of each. Here are 5 synthetic comments representing the themes: …”

Retention and deletion: The university uses an approved AI system with a policy that data is deleted after 30 days and not used for training. This is verified.

Show full worked solution

Recommendation: Proceed with the minimized, aggregated approach. The data is sufficiently de-identified (no direct identifiers, indirect identifiers generalized), the system is approved, and retention/deletion policies are verified. The analysis will provide useful themes without compromising student privacy.

Residual risk: Even with aggregation, small groups (e.g., a single student in a small course) could still be identifiable. If the dataset is small, consider using only synthetic data and not uploading any real feedback.

14. Guided Learning Activities

🧩 Activity 8.2.A: Minimum-Necessary Information Audit

Purpose: To practise identifying which data fields are essential, optional, unnecessary, or replaceable.
Learning outcome: Apply data minimization.
Estimated time: 15 minutes.

Scenario: You are a HR analyst. You have a spreadsheet with employee data: Name, Employee ID, Department, Job Title, Salary, Performance Rating, Home Address, Date of Birth, Emergency Contact Name, Emergency Contact Phone. You want to use an AI system to analyse the relationship between performance rating and salary by department.

Task: Classify each field as: essential, useful but optional, unnecessary, sensitive, requiring authorization, replaceable with synthetic data, or uncertain. Then create a minimized dataset.

Show model analysis

Essential: Department, Job Title (or category), Performance Rating, Salary.
Useful but optional: Employee ID (for tracking, but can be pseudonymized).
Unnecessary: Name, Home Address, Date of Birth, Emergency Contact.
Sensitive: Salary, Performance Rating (could identify individuals in small departments).
Requiring authorization: All employee data; you need HR approval.
Replaceable: Employee ID can be replaced with a random identifier.

Minimized dataset: Department, Job Title Category, Performance Rating (scale), Salary (range or anonymized). Use a random ID for tracking.

🧩 Activity 8.2.B: De-Identification Comparison

Purpose: To distinguish deletion, redaction, masking, pseudonymization, anonymization, aggregation, and synthetic substitution.
Learning outcome: Distinguish de-identification methods.
Estimated time: 15 minutes.

Scenario: A dataset contains patient records: Patient Name, MRN, Diagnosis, Date of Visit, Provider Name.

Task: For each of the following actions, identify the de-identification method:

Removing the patient name column.
Replacing the MRN with a random code, but keeping a lookup table.
Blacking out the provider name in a document.
Creating a summary report that says “10 patients had diabetes” without any individual data.
Writing a synthetic case study that illustrates a typical treatment plan.
Replacing all dates with “2024”.

Show model answers

Deletion (removing the column).
Pseudonymization (replacing with a code, retains re-identification capability).
Redaction (obscuring).
Aggregation (summary).
Synthetic substitution (invented example).
Generalization (a form of de-identification, though not a separate method; often considered masking or anonymization depending on context).

🧩 Activity 8.2.C: Re-Identification Risk Analysis

Purpose: To identify combinations of indirect identifiers that can lead to re-identification.
Learning outcome: Assess re-identification risk.
Estimated time: 15 minutes.

Scenario: A public dataset contains the following fields for each individual: Zip Code (first 3 digits), Age (exact), Gender, Occupation, Marital Status, and a “rare disease” flag (yes/no).

Task: Identify which combinations could re-identify a person. What if the zip code is very small? What if the occupation is unique? What if the age is 99?

Show model analysis

Re-identification risk: The combination of zip code prefix, exact age, gender, and occupation can uniquely identify many individuals. If a rare disease is also present, it narrows it further. In a small geographic area with a unique occupation and age, re-identification is almost certain.

Mitigation: Generalize age to ranges, combine zip code to larger regions, aggregate rare disease counts instead of individual flags, or use synthetic data.

🧩 Activity 8.2.D: Memory and Retention Map

Purpose: To map where your data may reside when using an AI system.
Learning outcome: Assess memory and retention risks.
Estimated time: 15 minutes.

Scenario: You use a public AI chatbot to help with a work project. You upload a document and chat with the system over several sessions. The system has a memory feature that remembers your preferences.

Task: Map the following locations where your information might be stored: current prompt, conversation history, persistent memory, retrieval repository, system logs, exported records, human notes, deletion request, possible secondary use.

Show model map

Current prompt: Transient, may be stored temporarily.
Conversation history: May be stored for the session or longer.
Persistent memory: If enabled, the system may remember facts across sessions.
Retrieval repository: Uploaded documents may be stored for retrieval.
System logs: Interaction logs for monitoring.
Exported records: If you download or share outputs.
Human notes: Your own notes may contain copied information.
Deletion request: You may request deletion, but it may not be complete.
Secondary use: The provider may use your data for training or analytics.

🧩 Activity 8.2.E: Privacy-Preserving Prompt Redesign

Purpose: To replace unnecessary real-world detail with generalized, synthetic, or aggregated information.
Learning outcome: Redesign a prompt using synthetic or generalized information.
Estimated time: 15 minutes.

Original prompt: “I have a list of 10 employees: John (age 34, salary $75,000), Mary (age 29, salary $68,000), … Please calculate the average salary by department: Marketing, Sales, Engineering. Here are the exact names and ages.”

Task: Redesign the prompt to minimize privacy risk while still calculating the average salary by department. Use generalized or synthetic data.

Show model redesign

Redesigned prompt: “I have salary data for 10 employees in three departments: Marketing (3 employees, salaries: $70k, $75k, $80k), Sales (4 employees: $60k, $65k, $68k, $70k), Engineering (3 employees: $90k, $95k, $100k). Please calculate the average salary for each department. Do not use any names or ages.”

Why this is safer: No names, ages, or exact identifiers. The data is aggregated by department with salaries rounded to the nearest thousand. This still allows the calculation without exposing individual identities.

15. Exercises

📝 Exercise 8.2.1: Apply Data Minimization

Difficulty: Introductory
Estimated time: ~10 min
Learning outcome: Apply data minimization.

Scenario: You are a researcher studying the effect of a new teaching method on student performance. You have a dataset with: Student Name, Student ID, Age, Gender, Major, GPA, Course Grades, Instructor Name, Semester. You want to use an AI system to analyse the correlation between the new teaching method (applied in some sections) and final grades.

Task: Identify which fields are essential, which can be omitted, which should be generalized, and which should be replaced with synthetic data. Justify your choices.

Show sample answer

Essential: Course Grades, Teaching Method (new vs. control).
Useful but optional: Major, Semester (for context), GPA (as a control).
Omit: Student Name, Student ID (not needed for correlation).
Generalize: Age to range (e.g., 18–22), Instructor Name to “Instructor”.
Synthetic: Replace exact grades with grade categories (A, B, C) or use synthetic grade distributions.
Justification: The analysis does not need individual identification. By removing names and IDs, and generalizing other fields, you reduce re-identification risk while preserving the analytical value.

📝 Exercise 8.2.2: Distinguish Redaction and Anonymization

Difficulty: Intermediate
Estimated time: ~8 min
Learning outcome: Distinguish redaction from anonymization.

Scenario: A document contains a person’s name, address, and medical diagnosis. You remove the name and address (redaction) and leave the diagnosis. Is the document anonymized?

Show answer

No. Redaction removes some information, but the remaining information (diagnosis) may still identify the person if other data is available (e.g., the document context, or a small population). Anonymization requires that the remaining information cannot reasonably identify the person, considering all available auxiliary data. Redaction is a step toward anonymization, but not sufficient on its own.

📝 Exercise 8.2.3: Distinguish Pseudonymization and Anonymization

Difficulty: Intermediate
Estimated time: ~8 min
Learning outcome: Distinguish pseudonymization from anonymization.

Scenario: You replace all patient names with unique codes, but keep a lookup table that maps codes to names. Is this anonymization or pseudonymization? Explain.

Show answer

This is pseudonymization because the mapping table allows re-identification. Anonymization would require that the mapping is destroyed or that re-identification is not practically possible even with auxiliary data. Pseudonymization reduces risk but does not eliminate it.

📝 Exercise 8.2.4: Identify Indirect Identifiers

Difficulty: Intermediate
Estimated time: ~8 min
Learning outcome: Identify indirect identifiers.

Scenario: A dataset about university students contains: Major, Year of Study, Home Country, Number of Courses Taken, Club Membership.

Task: Which of these could be indirect identifiers? Explain.

Show answer

All of them can be indirect identifiers when combined. For example, a student in a small major (e.g., “Classics”) from a specific country in a certain year with a unique club membership may be uniquely identified. The more unique the combination, the higher the re-identification risk.

📝 Exercise 8.2.5: Assess Memory, Retention, and Secondary-Use Questions

Difficulty: Advanced
Estimated time: ~10 min
Learning outcome: Assess memory, retention, and secondary-use questions.

Scenario: You are considering using a public AI system to analyse customer feedback. The system’s privacy policy states: “We may retain your interactions for up to 90 days for quality improvement.” It also says: “We may use aggregated data for research.”

Task: What are the risks? Should you proceed? What questions should you ask?

Show sample answer

Risks: Your customer feedback may be retained for 90 days, and the provider may use aggregated data for research (secondary use). Even if you delete your session, the data may persist. If the feedback contains personal or confidential information, this is a risk.

Questions to ask: Can I opt out of retention? Can I request deletion? Is the aggregation truly anonymous? What is the purpose of the research? Can I see their research findings?

Recommendation: If the feedback is sensitive, do not proceed without explicit consent and a clear understanding of the provider’s practices. Consider using an approved system with stricter controls.

📝 Exercise 8.2.6: Redesign a Prompt Using Synthetic or Generalized Information

Difficulty: Advanced
Estimated time: ~10 min
Learning outcome: Redesign a prompt using synthetic or generalized information.

Original prompt: “Here is a patient record: Name: Alice Johnson, Age: 45, Diagnosis: Type 2 Diabetes, Medication: Metformin, Dosage: 500mg twice daily. Please provide a summary of the treatment plan.”

Task: Redesign the prompt to use synthetic or generalized information while still obtaining a useful treatment plan summary.

Show model redesign

Redesigned prompt: “Provide a typical treatment plan summary for a patient with Type 2 Diabetes who is prescribed Metformin 500mg twice daily. Do not use any real patient identifiers. Use general language.”

Why this is safer: No real patient data is used. The request is for general medical information, which does not require personal details.

16. Homework Problems

Formative · Ungraded · Recommended preparation for Assignment 3.

🧠 Problem 8.2.1: Minimize a Dataset

Estimated time: ~10 min

Scenario: You have a dataset of customer orders: Order ID, Customer Name, Customer Email, Product Name, Quantity, Price, Shipping Address, Payment Method, Order Date. You want to use an AI system to forecast future product demand based on historical sales.

Task: Minimize the dataset. What fields should you keep, remove, or generalize? Justify.

Show sample answer

Keep: Product Name (or Product Category), Quantity, Price (or Revenue), Order Date (or Month).

Remove: Customer Name, Email, Shipping Address, Payment Method.

Generalize: Order Date to Month/Year; Price to price range.

Justification: Demand forecasting does not need individual customer identities. It needs product-level time-series data. Removing personal data reduces privacy risk.

🧠 Problem 8.2.2: De-Identification Classification

Estimated time: ~8 min

Scenario: A hospital publishes a dataset of patient visits with the following transformations:

Patient names are replaced with random codes, but a key is kept.
Dates are replaced with age ranges.
Diagnoses are grouped into broad categories.
The dataset is released publicly.

Task: Identify which transformations are pseudonymization, anonymization, aggregation, or generalization. Is the dataset truly anonymous?

Show sample answer

Random codes with a key: Pseudonymization.
Age ranges: Generalization.
Grouped diagnoses: Aggregation (or categorization).

The dataset is not truly anonymous because the pseudonymization key exists, and the combination of age, diagnosis, and other factors might still re-identify individuals. Public release of such data requires careful anonymization, not just pseudonymization.

🧠 Problem 8.2.3: Indirect Identifiers

Estimated time: ~8 min

Scenario: A library publishes anonymised borrowing records with: Book Title, Borrow Date, Return Date, Library Branch, Patron Age Group (18–25, 26–35, etc.), and Patron ZIP (first 3 digits).

Task: Identify potential indirect identifiers and explain how they could lead to re-identification.

Show sample answer

Indirect identifiers: Borrow Date, Return Date, Library Branch, Age Group, ZIP prefix. A combination of a specific book, a unique borrow date, a small branch, and a rare age group could identify a patron, especially if the patron’s borrowing history is distinctive. Even with ZIP prefix, if the branch is small, it narrows the population.

🧠 Problem 8.2.4: Re-identification Risk Analysis

Estimated time: ~10 min

Scenario: A company releases a dataset of employee commute times with: Age (exact), Gender, Department, Job Title, and Commute Time (minutes). The company has 500 employees, but the “Research” department has only 5 employees.

Task: What is the re-identification risk for Research department employees? What could be done to mitigate?

Show sample answer

Risk: High. With only 5 employees, the combination of Age, Gender, Job Title, and Commute Time can easily identify each person. An external attacker could use public data (e.g., social media) to link to individuals.

Mitigation: Aggregate the Research department data (e.g., average commute time), generalize Age to ranges, or combine departments to increase group size. Better: do not release small-group data at all.

🧠 Problem 8.2.5: Persistent Memory

Estimated time: ~8 min

Scenario: An AI assistant has a “memory” feature that stores facts about users across sessions. You tell it your name, workplace, and project details. A week later, you ask it a general question, and it responds using your stored workplace context.

Task: What are the risks? Should you use this feature for work-related information?

Show sample answer

Risks: The memory feature may retain sensitive information indefinitely. If the system is compromised, your data could be exposed. Even without compromise, the assistant might inadvertently reveal stored information in responses to others (if multi-user) or in training data.

Recommendation: Do not store sensitive or confidential information in persistent memory. Turn off memory if possible, or use a system that does not retain information across sessions. For work, use a dedicated, approved system with clear data-handling policies.

🧠 Problem 8.2.6: Retention Policy

Estimated time: ~8 min

Scenario: An organisation uses an AI system that stores all conversations for 1 year for “quality assurance.” An employee accidentally uploads a confidential client list.

Task: What should the employee do? What are the retention risks?

Show sample answer

Immediate action: Stop using the system, report the incident to the privacy/security team, and request deletion of the uploaded data. However, if retention is 1 year, the data may persist even after the employee’s session ends.

Risks: The confidential client list may be accessible to the AI provider’s staff, used for training, or exposed in a breach. The longer the retention, the higher the risk.

Mitigation: Review the organisation’s policy on using AI for confidential data. If not allowed, do not upload. If allowed, ensure the system has short retention and no secondary use.

🧠 Problem 8.2.7: Secondary Use

Estimated time: ~8 min

Scenario: You are a journalist. You use a public AI system to analyse a large set of public government documents for a story. The system’s terms say: “We may use aggregated data for training.”

Task: Is this secondary use? What are the implications?

Show sample answer

Yes, this is secondary use: the system may use your analysis (or the documents you uploaded) for training its models. Even though the documents are public, your specific queries and analysis might reveal your investigative focus. The training use is not part of your original purpose (analysing for a story). You may want to consider using a system that does not train on user data.

🧠 Problem 8.2.8: Redesign a Prompt

Estimated time: ~10 min

Original prompt: “I am a teacher. I have the following student data: Student A – test scores: 85, 90, 78; Student B – 92, 88, 95; Student C – 70, 65, 72. Please calculate the average and identify students who are below 70.”

Task: Redesign the prompt to avoid identifying students.

Show model redesign

Redesigned prompt: “I have a class of 3 students with test scores: 85, 90, 78; 92, 88, 95; 70, 65, 72. Please calculate the average per student and tell me which students (by number only, e.g., Student 1, 2, 3) have an average below 70. Do not use any names or identifiers.”

Why this is safer: It uses generic labels (Student 1, 2, 3) and does not include any real names or other identifying information. The analysis still works.

🧠 Problem 8.2.9: Transfer of Minimized Data

Estimated time: ~10 min

Scenario: You have minimized a dataset for analysis. You want to share the minimized dataset with a collaborator via email.

Task: What risks remain even after minimization? How should you transfer it?

Show sample answer

Risks: Even minimized data may still contain indirect identifiers. Email is not secure; it could be intercepted or accidentally sent to the wrong person. The collaborator may not have the same privacy practices.

Recommendation: Use a secure file transfer method (e.g., encrypted email, secure cloud storage with access controls). Ensure the collaborator agrees to handle the data responsibly. Consider whether the minimization is sufficient for the context; if not, further reduce or use synthetic data.

🧠 Problem 8.2.10: Deletion Verification

Estimated time: ~8 min

Scenario: You delete a chat history from an AI system’s interface. The system says “deleted successfully.”

Task: Can you be certain the data is gone? Why or why not? What should you do?

Show sample answer

No, you cannot be certain. The system may retain backups, logs, or training data. The “delete” may only remove the chat from the user interface, not from all backend systems.

What to do: Check the provider’s privacy policy to understand their deletion practices. If you need guaranteed deletion, ask for a formal deletion request and confirmation. Consider using a system that does not retain data at all, or avoid uploading sensitive data in the first place.

🧠 Problem 8.2.11: Minimization and Purpose

Estimated time: ~10 min

Scenario: A social worker wants to use an AI system to summarise client intake forms to identify common issues. The forms contain: name, address, phone, income, family members, health conditions, and a narrative.

Task: What is the legitimate purpose? What fields are essential for summarising common issues? What fields must be excluded? Propose a minimised intake form for AI processing.

Show sample answer

Legitimate purpose: To identify common issues among clients to improve services.

Essential fields: Health conditions, family members (aggregated), income (range), narrative (but redacted or synthetic).

Excluded: Name, address, phone (direct identifiers).

Minimised form: Health conditions (list), number of family members, income range, and a synthetic narrative that captures the main themes without real details. No names, contact info, or exact addresses.

17. Mini-Project: Privacy-Preserving Context Redesign

📁 Project: Privacy-Preserving Context Redesign

Purpose: To extend the Lesson 8.1 activity by applying minimization, de-identification, and retention/memory assessments to a synthetic AI-supported activity.
Learning outcomes: Apply data minimization, distinguish de-identification methods, assess re-identification and inference risks, and evaluate memory/retention/secondary use.
Estimated effort: 75–100 minutes.

Context

Use the same synthetic activity you selected in Lesson 8.1 (or choose a new one from the list). You will now extend your analysis with the following components.

Deliverable

Complete the following sections for your chosen context:

Original synthetic context (from Lesson 8.1)
Necessary information
Unnecessary information
Direct identifiers
Indirect identifiers
Sensitive inferences
Selected transformation method
Redaction or generalization
Synthetic substitution
Residual re-identification risk
Conversation-history question
Persistent-memory question
Retention question
Secondary-use question
Deletion question
Revised context
Revised prompt
Human-review requirement
Stop condition
Recommendation

Assessment criteria

Completeness: All 20 items are addressed.
Accuracy: De-identification methods are correctly identified and applied.
Risk assessment: You identify residual re-identification and inference risks.
Memory/retention: You ask appropriate questions and consider their implications.
Recommendation: Your final recommendation is justified and realistic.

Self-review checklist

I have listed all necessary and unnecessary information.
I have identified direct and indirect identifiers.
I have chosen and applied a de-identification method.
I have assessed residual re-identification risk.
I have considered memory, retention, and secondary use.
I have redesigned the context and prompt.
I have defined human-review and stop conditions.
My recommendation is clear and supported.

Show Hint 1: Begin with the inventory

Start by listing every piece of information in your chosen context. Then, for each, decide if it is necessary, optional, or unnecessary. Then identify direct and indirect identifiers.

Show Hint 2: Choose de-identification method

Consider the level of risk. If you are using a public AI system, anonymization or synthetic substitution is safest. If you are using an approved system with strong controls, pseudonymization or aggregation may be acceptable.

Show Hint 3: Ask about memory and retention

Think about where your data goes: Does the system remember across sessions? How long is it kept? Can you delete it? Will it be used for training? If you cannot verify, assume the worst and minimize accordingly.

Show solution architecture

Original context: Briefly describe the scenario.
Necessary information: List fields required for the task.
Unnecessary information: List fields that can be omitted.
Direct identifiers: Names, IDs, etc.
Indirect identifiers: Dates, locations, unique attributes.
Sensitive inferences: What could be inferred from the remaining data?
Transformation method: Choose redaction, generalization, pseudonymization, anonymization, aggregation, or synthetic.
Redaction/generalization: Apply it (e.g., replace exact ages with ranges).
Synthetic substitution: Create synthetic examples if needed.
Residual risk: Even after transformation, what risk remains?
Conversation history: Will the system store the session?
Persistent memory: Will it remember across sessions?
Retention: How long is data stored?
Secondary use: Will your data be used for other purposes?
Deletion: Can you delete it? How?
Revised context: Describe the minimized context.
Revised prompt: Write the actual prompt.
Human review: Who should check the prompt before use?
Stop condition: When should you not proceed?
Recommendation: Proceed, proceed with safeguards, redesign, use alternative, or stop.

Show illustrative partial example (different context)

Example context: A healthcare administrator wants to use an AI system to identify patients at high risk of readmission based on discharge summaries. The summaries contain patient name, MRN, diagnosis, medications, discharge date, and a narrative.

Necessary: Diagnosis, medications, discharge date (generalized), narrative themes.

Unnecessary: Name, MRN, exact discharge date.

Direct identifiers: Name, MRN.

Indirect identifiers: Discharge date (if unique), specific diagnosis (if rare).

Transformation: Remove names and MRN. Generalize discharge date to month. Redact any unique identifiers in the narrative (e.g., specific hospital units). Use synthetic narrative examples.

Residual risk: Even with redaction, the combination of diagnosis and medications might identify a patient in a small population.

Memory/retention: The system will store the query for 30 days; we need to ensure it is not used for training.

Revised prompt: “I have a set of discharge summaries with the following information: diagnosis (coded), medications list, and a brief narrative summary (synthetic). Please flag any cases that show risk factors for readmission.”

Recommendation: Proceed with safeguards: use an approved system, ensure no retention, and have a clinician review the flagged cases.

Submit your completed template as part of your Unit 8 portfolio.

19. Assignment Connections

Assignment 3: Responsible AI Case Analysis

Lesson 8.2 contributes evidence to Assignment 3. Retain the following:

Data minimization: what information is essential, optional, or unnecessary.
De-identification methods applied (redaction, generalization, pseudonymization, anonymization, aggregation, synthetic substitution).
Direct and indirect identifiers identified.
Re-identification and inference risk assessments.
Memory, retention, secondary use, and deletion questions and answers.
Your redesigned prompt and context.
Residual uncertainty and limitations.

PROTECT elements to apply: The Controls (C) element—specifically minimization, de-identification, retention, and deletion controls.

📝 Assignment 1: Reflective Journal

Reflection prompts:

Why is removing names not enough to anonymize information? Provide an example from your own experience or a hypothetical scenario.
How does data minimization change the way you think about using AI for tasks that involve personal information?
What are your concerns about AI systems retaining memory or conversation history? How does that affect your trust in them?
How does secondary use (e.g., training) affect your decision to use a public AI system for any task?

Do not share real personal or confidential information. Use hypothetical examples.

Show reflection-planning checklist

I have considered why removing names is insufficient.
I have reflected on how minimization affects my AI use.
I have examined my concerns about memory and retention.
I have thought about the implications of secondary use.

20. Key Takeaways

Remember these points

Data minimization is a core principle: use only what is necessary.
De-identification is a spectrum: deletion, redaction, masking, pseudonymization, anonymization, aggregation, and synthetic substitution each have different levels of risk.
Removing names does not equal anonymization—indirect identifiers and inference risks remain.
Re-identification can occur when indirect identifiers are combined, especially in small groups.
Conversation history, persistent memory, and retention create ongoing privacy risks—verify system practices.
Secondary use (e.g., model training) is a new purpose requiring new authority.
User-visible deletion is not complete deletion—confirm with the provider.
Privacy-preserving alternatives include synthetic, generalized, or aggregated data, and processing locally.

21. Key Terms

Data minimization: Limiting information to what is relevant and necessary for the authorised purpose.
Deletion: Removing information from a particular location or record.
Redaction: Removing or obscuring selected information from a document.
Masking: Replacing information with altered or hidden values.
Pseudonymization: Replacing direct identifiers with codes while retaining a means of reconnection.
Anonymization: Transforming information so that people are not reasonably identifiable under the applicable context.
Aggregation: Combining information into groups or summaries.
Synthetic substitution: Using invented but representative information rather than real records.
Direct identifier: Information that uniquely identifies a person (e.g., name, ID).
Indirect identifier: Information that can be combined with other data to identify a person.
Re-identification: Matching de-identified information to an individual using auxiliary data.
Inference: Deriving sensitive information from apparently non-sensitive data.
Conversation history: Earlier messages retained in the current interaction.
Persistent memory: Information stored for use across later interactions.
Retention: The storage of information over time, including duration, purpose, and access.
Secondary use: Using information for a purpose beyond the original authorised purpose.

22. Looking Ahead: Lesson 8.3

In Lesson 8.2, you learned to minimize and de-identify information and assess memory and retention risks. In Lesson 8.3: Prompt Injection, Tool Permissions, and Secure AI Workflows, you will learn to:

Distinguish authorised instructions from untrusted content.
Identify prompt-injection risks defensively.
Apply least privilege to tools and data access.
Classify read, draft, modify, send, publish, transact, approve, and delete permissions.
Design review and authorization gates.
Define secure stop conditions.

This builds on minimization and de-identification by adding controls over how AI systems access and act on information.

Continue to Lesson 8.3: Prompt Injection, Tool Permissions, and Secure AI Workflows Return to Unit 8 Home

23. Sources & Further Reading

Primary: Chapter 10: Privacy, Security, and Data Protection (sections on data minimization, de-identification, retention, and memory).
Supporting: Chapter 6: Human-AI Collaboration (accountability).
Supporting: Chapter 7: Hallucination, Error, and Uncertainty (risk awareness).
Appendix A: Generative AI Glossary.
Appendix D: Responsible-Use Toolkit.
Appendix E: AI Workflow Design Toolkit.

[VERIFICATION REQUIRED: Additional sources, page numbers, and jurisdiction-specific references will be confirmed when the final textbook is supplied.]

⚠️ Note

Some textbook content, definitions, examples, and figures are marked with placeholders. These will be supplied by the course coordinator or subject-matter expert.

Data Minimization, De-Identification, Memory, and Retention

Table of Contents

1. Lesson Overview

2. Learning Outcomes

3. Before You Begin

4. Retrieval Practice: Concepts from Lesson 8.1

5. Opening Scenario: "The Research Interview"

6. Data Minimization

7. De-Identification Methods

8. Direct, Indirect, and Inference Risks

9. Conversation History, Persistent Memory, and Retention

10. Secondary Use and Deletion

11. PROTECT Walkthrough — Controls

12. Process Walkthrough: From Full Data to Minimized, Privacy-Preserving Input

13. Worked Example: Analysing Student Feedback

Minimization Steps

14. Guided Learning Activities

15. Exercises

16. Homework Problems

17. Mini-Project: Privacy-Preserving Context Redesign

Context

Deliverable

Assessment criteria

Self-review checklist

18. Self-Check Quiz

19. Assignment Connections

20. Key Takeaways

21. Key Terms

22. Looking Ahead: Lesson 8.3

23. Sources & Further Reading