A library chatbot helps with reference questions. Which privacy control best fits those conversational sessions?

Refusing to collect unnecessary library-card details during reference chats applies purpose limitation to conversational civic AI: a chatbot answering general reference questions needs the query and limited session context, not a full identity dossier. The correct control works because libraries have a long-standing confidentiality ethos; minimizing card and household data collection reduces breach impact, chilling effects on inquiry, and temptation to collect unnecessary card details and rely on encryption unrelated to answering the question. Encrypting unnecessary library-card details collected during reference chats fails conceptually by substituting encryption for minimization, keeping data that exceeds what the chat session requires. Isolating library-card details from reference chat transcripts for storage fails both collection minimization and identity-linkage hygiene, creating a retained store of unnecessary card data that can be breached, re-linked, or misused even when kept separate. Retaining hashed library-card details alongside reference chat transcripts fails by preserving unnecessary collection and linkage that is not necessary for the service function, since hashing still leaves re-identifiable data tied to what patrons asked. Exam caveat: retaining hashed library-card details may still be appropriate for account-specific actions such as holds, fines, or personal reading history without making hashed retention alongside transcripts the default for general reference Q&A. Operational check: configure the library chatbot to answer general reference without card input, reserve card use for account-specific flows, set short transcript retention with unlink where possible, and review flows to ensure they do not reintroduce prohibited encryption of unnecessarily collected details, isolated storage of unnecessary details, or hashed retention alongside transcripts.