An AI governance team is conducting a privacy risk assessment for a new AI-powered employee monitoring system that tracks keystrokes, screen content, and application usage to detect potential insider threats. Which privacy principle is MOST threatened?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — you're looking at data minimization because keystroke logging and full-screen capture grab way more personal data than you need to catch insider threats. You can often spot risk with less invasive signals like access logs, anomalous data transfers, and login behavior.
Full Explanation
The correct principle is data minimization, because keystroke logging and full screen content capture are highly invasive and collect substantially more data than needed to detect insider threats. Insider threat detection can often be accomplished with less invasive signals such as access logs, anomalous data transfer patterns, and login behavior. Capturing all keystrokes and screen content violates the data minimization principle. The purpose limitation option, which says the collected monitoring data is used only for insider threat detection, is not violated in this scenario since the data is used for the stated purpose. The accuracy option, which says the monitoring data may not accurately represent employee performance, and the storage limitation option, which says the monitoring data is retained for more than three years, may be concerns but are not the most threatened privacy principle given the scope of collection described.