An AI audit team is reviewing the data governance practices for an AI model used in hiring. The team discovers that training data containing demographic information was retained after model development without documented justification. Under GDPR, which principle is MOST likely violated?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — you're right to pick storage limitation because GDPR says personal data shouldn't be kept longer than necessary. Once hiring-model training is done, keeping demographic data without a documented reason breaks that rule.
Full Explanation
Storage limitation is correct because GDPR's storage limitation principle, found in Article 5, requires that personal data be kept no longer than necessary for the purposes for which it is processed. Once model training is complete and the data is no longer needed for a specific, documented purpose, such as model retraining or regulatory audit, retaining it without justification violates this principle. The accuracy option, which says the demographic data may not be current or accurate, concerns data correctness, not retention duration. The integrity and confidentiality option, which says the data is stored without encryption, is a security principle applicable regardless of how long data is retained. The lawfulness option, which says processing demographic data for AI training requires explicit legal basis, concerns the legal basis for initial processing, which may have been valid at the time of collection.