Data Minimization, Purpose Limitation, Consent, and Retention

Purpose, necessity, lawful basis, retention, deletion: each row constrains the one below it, and the last one reaches into models and backups.

That last row is not a metaphor, and it is not aspirational. In January 2021 the Federal Trade Commission settled with Everalbum, and the order did not stop at the photos. It required deletion of the users' photos and videos. It required deletion of the face embeddings created without affirmative express consent. And it required deletion of the models and algorithms developed in whole or in part from those users' images. European regulators have since said the same. EDPB Opinion 28/2024, adopted 17 December 2024, states that AI models trained on personal data cannot, in all cases, be considered anonymous. Where development rested on unlawfully processed personal data, the corrective measures available run as far as erasure of the whole training dataset and of the AI model itself.

Read the five rows downward and the fifth is not a disposal step at the end. It is the row that decides whether the four above it were ever real.

On 31 May 2023 the FTC and DOJ charged Amazon over the children's voice recordings collected through Alexa. The complaint alleged three things. Amazon retained those recordings indefinitely by default. It used the unlawfully retained recordings to improve the Alexa algorithm. And when a parent requested deletion, it failed to delete the transcripts of what children said from all of its databases.

The FTC's Bureau of Consumer Protection director, Samuel Levine, put it in one line: “COPPA does not allow companies to keep children’s data forever for any reason, and certainly not to train their algorithms.”

The stipulated order was entered on 19 July 2023, in the Western District of Washington. It imposed a $25 million civil penalty. It required deletion of voice and geolocation information on request. It required Amazon to identify and delete inactive child profiles — profiles not used for 18 months — unless a parent asks that they be kept. And it prohibited use of that data for the creation or improvement of any data product.

Nothing in that sequence needed a villain. It needed a default, a purpose written wide enough to absorb the default, and a deletion routine that ran in one system while the data sat in several.

Consent rests on a person agreeing. Legitimate interest rests on whoever holds the data doing the balancing. Contractual necessity rests on the duty actually existing.

The third of those has been tested to a figure. On 4 January 2023 Ireland's Data Protection Commission fined Meta Platforms Ireland €210 million over Facebook and €180 million over Instagram, and directed compliance within three months. The decisions had been adopted on 31 December 2022. The finding is in the regulator's own press release: “the DPC’s decisions include findings that Meta Ireland is not entitled to rely on the “contract” legal basis in connection with the delivery of behavioural advertising as part of its Facebook and Instagram services, and that its processing of users’ data to date, in purported reliance on the “contract” legal basis, amounts to a contravention of Article 6 of the GDPR.”

The DPC had not reached that conclusion on its own. Ten of the 47 concerned supervisory authorities objected to its draft decisions, one objection later withdrawn in the Facebook case. On 5 December 2022 the European Data Protection Board overruled the DPC's view. Performance of a contract, under Article 6(1)(b) GDPR, could not carry behavioural advertising. Scope follows the duty or service. A contract users had genuinely accepted did not stretch to cover what was built on top of it.

The second column has a published test rather than a disposition. EDPB Opinion 28/2024, which the Irish regulator itself asked for, sets out three steps: identify the interest, test necessity, then balance. The interest has to be lawful, clearly and precisely articulated, and real and present rather than speculative. On the middle step: “With respect to the second step, the Opinion recalls that the assessment of necessity entails considering: (1) whether the processing activity will allow for the pursuit of the legitimate interest; and (2) whether there is no less intrusive way of pursuing this interest.” Necessity is not usefulness. It asks whether a less intrusive route exists, with the amount of personal data processed weighed in light of the data minimisation principle.

Data minimization means collecting and retaining data that are adequate, relevant, and necessary for a defined purpose. Purpose limitation constrains incompatible reuse. Consent, when used, must be informed, specific, freely given, and withdrawable, not a blanket permission for future AI work. Responsible programs separate six purposes: development, evaluation, security, personalization, analytics, and legal retention. For each one they define the fields, the granularity, who may reach the data, how long it is kept, when it is deleted, and who reviews any secondary use. They weigh the other lawful bases as they go, and whatever each jurisdiction separately requires.

Separating the six is also what makes the necessity test answerable at all. Opinion 28/2024 requires the interest to be clearly and precisely articulated, and real and present rather than speculative. Then it asks whether there is a less intrusive way of pursuing it, with the amount of personal data weighed in light of the data minimisation principle. Both questions need a named purpose to be asked against. Bundled into one screen, the six collapse into a single undifferentiated assertion: everything collected is needed for something. That is the shape the Conseil d'État found insufficient, when purposes arrived inside a global acceptance of general terms.

Separating them is what stops one recording corpus from quietly becoming the training corpus for the algorithm.

Pick five sensitive fields and write down why a coarser version of each one would break the service. Often it would not.

The four items below are the paperwork that survives contact with a supervisory authority: a ledger saying what each purpose is, a necessity test with a written answer, a retention trigger that fires without anyone choosing to fire it, and a gate standing in front of reuse.

Separating the purposes comes first. Service, training, evaluation and personalization arrive bundled into one consent screen and get justified as though they were one thing. The Conseil d'État settled in 2020 what that bundle is worth: consent collected in the context of overall acceptance of a service's general conditions of use does not have a specific character within the meaning of the GDPR.

Step two is not a matter of house style. Opinion 28/2024 gives it a published form: identify the interest, test necessity, then balance. Necessity asks whether the processing activity will allow for the pursuit of the interest, and whether there is no less intrusive way of pursuing it. That is a question with two written answers, not an instruction to think carefully about each field.

Step five is where the other cases in this lesson land. The Everalbum order reached the face embeddings, and the models and algorithms built from the images. Opinion 28/2024 contemplates erasure extending to the whole training dataset and to the model itself. So verifying lifecycle behaviour means backups, caches, derived artifacts and trained weights. A deletion that only clears the primary store is the deletion the Alexa complaint described, where transcripts remained in databases the parent's request never touched.

Deletion is the promise made most often and tested least often. Verify it against backups, caches and derived artifacts rather than against the policy.

An order has already been written that way. Everalbum ran the Ever photo app, and its enterprise face-recognition business traded as Paravision. The Federal Trade Commission settled with it on 11 January 2021, and the obligation reached past the records to what had been built out of them: “Part III of the proposed order requires Respondent to delete (A) photos and videos of Ever app Users who requested deactivation of their accounts, (B) face recognition data that it created without obtaining Users' affirmative express consent, and (C) models and algorithms it developed in whole or in part using images from Users' photos.” The FTC also alleged that until at least October 2019 Everalbum had deleted no deactivated user's content at all, and had retained it indefinitely. The order runs for 20 years.

Decide which failures of that verification force the team to redesign, restrict, remedy, or retire the system. That ladder has a published counterpart. Opinion 28/2024 states that AI models trained on personal data cannot, in all cases, be considered anonymous. It then grades the measures available where development rested on unlawfully processed personal data: “These may include, for instance, issuing a fine, imposing a temporary limitation on the processing, erasing part of the dataset that was processed unlawfully or, where this is not possible, depending on the facts at hand, having regard to the proportionality of the measure, ordering the erasure of the whole dataset used to develop the AI model and/or the AI model itself.” Retraining is named there as a factor in assessing proportionality. The cost of rebuilding is an argument the regulator will hear. It is not a reason the model is out of reach.

Three of the promises in this lesson are principles of European data protection law. Article 5(1)(b) of the GDPR requires that personal data be collected for specified, explicit and legitimate purposes. Article 5(1)(c) requires that it be adequate, relevant and limited to what is necessary for those purposes. Article 5(1)(e) requires that it be kept in a form permitting identification for no longer than the purposes require. Article 17 then gives a right to erasure. The principles are short.

The backup, the cache, the embedding and the model are where they are actually tested.