Privacy & Compliance · Study deck
Defining and Minimizing Personal Data
Picture a motion sensor that records only on or off.
Privacy Priya is your guide for this deck.
After studying this chapter
Learning objectives
You will be able to:
- Explain: The deeper layer explains why "we removed the names" is rarely the end of the privacy story, how security and privacy relate without being the same thing, and what a small, reviewable privacy record contains.
- Explain: The controller that can link the virtual identity back to the owner still holds personal data, and the design still needs purpose limits, access controls, retention rules, and a re-identification review.
- Explain: The lifecycle has six stages, and a privacy review asks a question at each one rather than assuming the data is fine once it has arrived.
Major section
A Receipt Becomes a Diary
One event may say little.
- A month of events can show sleep, work hours, visitors, illness, or an empty home.
- For each planned item, name the person it may describe, the purpose, who can see it, how long it stays, and what else it may reveal when joined with other records.
- A year of readings is different.
Major section
A Receipt Becomes a Diary (continued)
Collect less when the decision does not need more.
- No list can predict every future use or inference.
- The deeper sections explain personal data, context, and safeguards so new links, longer history, or a changed purpose reopen the review before harm occurs.
- One sensor reading can look as boring as one shopping receipt.
Major section
The Core Idea: Whose Data, What Risk?
Personal data is any information that relates to an identified or identifiable person.
- The second idea is that sensitivity depends on context.
- The same reading can be harmless or revealing depending on where it is taken, when, and about whom.
- The safest data is the data you chose not to collect.
Major section
The Core Idea: Whose Data, What Risk? (continued)
A motion event in a warehouse aisle is logistics; the same motion event in a bedroom at night is something else entirely.
- Because of this, privacy is not decided only by the data type; it is decided by the data *in its context*.
- Each reading looks minor, yet a stream of minor readings can become a detailed portrait of a person who never agreed to be portrayed.
- Identifiers, device IDs, locations, and patterns that can be linked to a person are all personal data, not just names and addresses.
Major section
The Core Idea: Whose Data, What Risk? (continued)
The same reading can be ordinary or revealing depending on the place, the time, and the person it describes.
- A motion sensor's simple on/off log looks harmless, yet over weeks it can reveal when someone is home, asleep, or away.
- A device identifier that never changes can act like a name, quietly linking all of one person's activity together.
- Smart-meter energy readings are just numbers, but their shape over a day can suggest when a household wakes, cooks, and sleeps.
- The examples become reviewable only when each concern is recorded with its context and response.
Major section
Practitioner: Lifecycle Defenses
The lifecycle has six stages, and a privacy review asks a question at each one rather than assuming the data is fine once it has arrived.
- Everything the sensor can read, just in case.
- Access limited to those who need it, protected at rest.
- Sharing is purposeful, limited, and recorded.
Major section
Practitioner: Lifecycle Defenses (continued)
Together they shrink the amount of personal data in the system, which shrinks everything that can go wrong with it later.
- Two ideas do most of the protective work, and they come before any encryption or access control.
- Purpose means deciding the specific reason for the data before collecting it, so collection is a deliberate choice rather than a default.
- That purpose needs temperature and a schedule, not a continuous record of exactly when each room is occupied.
Major section
Practitioner: Lifecycle Defenses (continued)
Minimization means collecting the least data that serves that purpose, at the lowest detail that still works, and keeping it for the shortest time that the purpose needs.
- Energy-use patterns can suggest daily routines; motion timing can suggest sleep and wake cycles; a step counter combined with location can suggest health conditions.
- A minute-by-minute occupancy log could reveal an empty-house pattern.
- Coarsening and short retention make that inference impossible rather than merely discouraged.
Major section
Under the Hood: Re-ID and Records
Many records still contain quasi-identifiers -- attributes that are not unique on their own but, in combination, can single out one person.
- Removing direct identifiers such as names is necessary but often not sufficient.
- Assuming only names count, while a fixed device ID acts like one.
- Combinations can re-identify even without names.
Major section
Under the Hood: Re-ID and Records (continued)
The controller that can link the virtual identity back to the owner still holds personal data, and the design still needs purpose limits, access controls, retention rules, and a re-identification review.
- Aims to make re-identification infeasible.
- Strongest reduction, but can lower data usefulness.
- Claiming it without testing whether linkage is still possible.
Major section
Under the Hood: Re-ID and Records (continued)
Confidentiality is the part most people picture as "privacy," and it is essential -- weak access control or unprotected storage turns a privacy plan into a wish.
- Privacy and security are related but distinct.
- You need both, and security is the boundary that makes the privacy decisions enforceable.
- Access is unrestricted or unknown.
Major section
Under the Hood: Re-ID and Records (continued)
The deeper layer explains why "we removed the names" is rarely the end of the privacy story, how security and privacy relate without being the same thing, and what a small, reviewable privacy record contains.
- Security protects data with the familiar triad of confidentiality (only authorized parties can read it), integrity (it is not altered without detection), and availability (it is there when legitimately needed).
- But strong security on over-collected data is still a privacy problem: perfectly encrypting data you should never have gathered does not make collecting it appropriate.
- Each data type and its sensing point are named.
Major section
Under the Hood: Re-ID and Records (continued)
The purpose is "possible future use.".
- Security keeps the right people out; privacy also asks whether the data should exist, for what purpose, and for how long.
- Data kept past the purpose that justified it is one of the quietest privacy liabilities.
- Location, access limits, and protection are stated.
Major section
Under the Hood: Re-ID and Records (continued)
It no longer serves the reason it was collected, yet it can still leak, be repurposed, or be demanded in a dispute.
- The fundamentals come together in a short record that another person can inspect.
- No retention limit or review trigger is recorded.
- These foundations are exactly what the privacy principles build upon.
Deck summary
Key takeaways
One event may say little.
- Collect less when the decision does not need more.
- Personal data is any information that relates to an identified or identifiable person.
- A motion event in a warehouse aisle is logistics; the same motion event in a bedroom at night is something else entirely.
- The same reading can be ordinary or revealing depending on the place, the time, and the person it describes.
Retrieval practice
Recall check 1 of 3
Privacy Priya says: answer from memory, then check your reasoning.
Q1Which statement best captures what counts as personal data in an IoT system?
Show answer
Answer: A Personal data is anything that relates to an identifiable person, so stable identifiers, locations, and behavioral patterns count too.
Retrieval practice
Recall check 2 of 3
Privacy Priya says: answer from memory, then check your reasoning.
Q2A team is unsure whether to store a minute-by-minute occupancy log from a home device. Which response best applies privacy fundamentals?
Show answer
Answer: B Purpose and minimization reduce the data, and addressing the inference risk directly makes the harmful pattern impossible rather than merely discouraged.
Retrieval practice
Recall check 3 of 3
Privacy Priya says: answer from memory, then check your reasoning.
Q3A team removes names from a dataset, replaces device IDs with reversible tokens, and calls the result 'anonymous and safe to share widely.' Why is this claim risky?
Show answer
Answer: C A reversible token keeps a path back to the person, and combinations of quasi-identifiers can re-identify individuals; this is pseudonymized data, not anonymized.
Print reference
Answers
Answer key.
- A · Personal data is anything that relates to an identifiable person, so stable identifiers, locations, and behavioral patterns count too.
- B · Purpose and minimization reduce the data, and addressing the inference risk directly makes the harmful pattern impossible rather than merely discouraged.
- C · A reversible token keeps a path back to the person, and combinations of quasi-identifiers can re-identify individuals; this is pseudonymized data, not anonymized.