A retailer plans to train a recommendation model on a cloud ML platform using purchase histories that include customer names, email addresses and home addresses. The data science team needs only purchase patterns. The privacy officer worries that the model could memorize and later reveal personal details. What is the best first step?
Select an answer to reveal the explanation.
Short Explanation
If the model never sees the names and addresses, it can't memorize them. That's data minimization in a nutshell: you don't protect what you never collect. Encryption and access controls are great, but the model still trains on decrypted plaintext, so they don't stop memorization.
Full Explanation
Data set privacy for machine learning starts with minimization: process only the personal data necessary for the purpose. Because the stated purpose needs purchase patterns, direct identifiers such as names, email addresses and street addresses should be removed, and remaining quasi-identifiers generalized or pseudonymized, before the data reaches the training pipeline. A model cannot memorize and regurgitate fields it never saw, and the de-identified set also shrinks the impact of any later breach of the training store. Encrypting the data set at rest protects the stored copy, but the training job decrypts it to learn from it, so the identifiers still enter the model. Restricting the prediction API narrows who can query the model, which lowers exposure, yet internal callers could still extract memorized details and the underlying privacy flaw remains. Choosing a private cloud changes where processing happens, not what data the model learns; memorization risk is identical on any infrastructure. Exam caveat: pseudonymized data generally remains personal data under GDPR, while properly anonymized data falls outside it; minimization is required either way. Operational check: run a data discovery scan on the prepared training set to confirm no direct identifiers remain before the training job is approved.