---
title: "Privacy, minimization, collateral data, retention, and deletion"
chapter: "23"
---

# Privacy, minimization, collateral data, retention, and deletion

Lawful authority does not remove privacy engineering. Systems should minimize identifiers and fields, isolate collateral data, restrict use, enforce time and purpose, and prove retention or deletion outcomes under applicable law.

> **Safety boundary:** this chapter teaches lawful, governed system design from
> public standards. It does not provide operational targeting, activation,
> decryption, surveillance-evasion, or covert collection instructions.

## The mental model

| Concept | Plain meaning | Control that must travel with it |
|---|---|---|
| **Purpose limitation** | Data is used only for the authorized purpose | Analytics and product reuse are prohibited by default |
| **Data minimization** | Only necessary authorized information is processed | Schema availability does not equal permission |
| **Collateral data** | Information about non-target parties may appear in communication | Handle under national law and strict access |
| **Retention schedule** | Material and audit evidence have governed lifetimes | Different classes may have different rules |
| **Legal hold** | Authorized preservation overrides normal deletion temporarily | Hold scope and release are controlled |
| **Deletion proof** | Data and keys are removed across copies and backups as required | A database row deletion is incomplete |

## Apply it as a controlled workflow

1. Create a field-level purpose, authority, sensitivity, and retention inventory.
2. Minimize at the earliest reliable boundary.
3. Separate operational evidence from intercepted material.
4. Enforce access by case, role, purpose, and time.
5. Propagate expiry, hold, and deletion across queues, replicas, caches, and backups.
6. Run regular data-location and deletion verification.

## Evidence to demand

- No LI material enters ordinary analytics, AI training, or troubleshooting datasets.
- Retention jobs fail closed and alert on unresolved copies.
- Backups have documented expiry, restore-time controls, and re-deletion behavior.
- Access reports support oversight of collateral-data handling.

## Failure to reason about

A support engineer copies a failed delivery payload into a ticket. The ticketing system now has different users, region, backup, and retention. Use synthetic diagnostics, opaque object references, and controlled evidence access instead.

## Feynman check

Permission to open one sealed letter does not permit copying it into the office notebook, training a robot on it, or keeping it forever.