Meridian Regional Airlines' customer-service virtual assistant currently logs a passenger's full frequent-flyer number, home address, and stored payment method on every interaction, even for simple questions like checking gate information. The AI project manager is asked to reduce the assistant's privacy exposure. What foundational privacy principle should guide the fix?

The correct answer applies data minimization, a foundational data privacy principle: collect and retain only the data actually necessary for the specific interaction, so a gate-information question triggers no pull of frequent-flyer number, address, or payment data at all. CPMAI treats data privacy principles as the foundation on which AI-specific privacy protections are built, and minimization is the first and most direct lever available to a project team. Encrypting data at rest is a real security control, but it is a downstream mitigation for data that should not have been collected in that context in the first place; it reduces the blast radius of a breach without reducing the exposure that exists every day the system runs normally. Requiring manager approval for access adds friction and an audit point, but the sensitive data is still being gathered and stored for every trivial request, so the underlying over-collection problem remains untouched. Moving to a vendor with a 'stronger security reputation' addresses a security question, not a privacy-by-design question, and it does nothing to stop the assistant from requesting more personal data than a given interaction requires. Minimization is the principle that actually shrinks the privacy risk at its source rather than managing the risk after the data already exists.