Privacy, consent, and data rights
Mental model: personal data does not stop being personal after tokenization, embedding, caching, or inclusion in a trace. Privacy engineering maps each data class through the system, attaches a purpose and retention rule, and makes access, correction, deletion, and incident paths executable. Requirements vary by jurisdiction; involve qualified privacy counsel for a real deployment.
Mechanism: data inventory → permitted purpose → propagation controls
For every input and derived artifact, record source, data class, purpose/legal basis, processor, storage location, access policy, retention, and deletion propagation. A retrieval index, eval export, support trace, and vendor request are separate stores, not one “database.” A rights request must locate all applicable copies and explain limits where removal from a trained model is not technically or legally equivalent to deleting a record.
stores = {"prompt_log": 30, "vector_index": 30, "eval_export": 7}
request = {"id": "u_8", "purpose": "support", "authorized": True}
assert request["authorized"] and all(days > 0 for days in stores.values())
print("deletion plan covers", sorted(stores))
Run with python3; expected output lists all three stores. The artifact proves only
inventory coverage; production deletion needs durable IDs, vendor contracts, and
verification receipts.
Controls and tradeoffs
Minimize fields before model calls; use scoped identities and encryption; redact where appropriate; segregate tenants; restrict review access; and expire prompts, caches, indexes, and exports. Pseudonymization lowers exposure but is not automatically anonymization. Fairness measurement can require sensitive data, while expanding its collection creates privacy risk: document necessity, safeguards, access, and deletion.
Failure modes and decision rule
“Consent” does not automatically authorize every secondary use. A removal from the primary database that leaves embeddings and traces is incomplete. Anonymization claims need contextual re-identification analysis. Do not send personal data to a model or provider until the purpose, access, retention, and rights workflow are recorded and approved; stop processing on a missing lawful route.
Exercises
- Extend the artifact with a cache and fail it when its retention exceeds the source policy.
- Trace one user document through ingestion, chunking, embedding, retrieval, logging, and deletion.
Connects to: PII in datasets · data leakage · oversight · artifact registry
Sources
- European Data Protection Board: AI — current AI/data-protection guidance hub.
- EDPB opinion on AI models — model anonymity, legitimate interests, and unlawful processing context.
- NIST AI RMF privacy guidance — privacy-enhanced AI as a lifecycle characteristic.