Collect only age band and region: Which action best applies minimization?
Minimization favors collecting only the fields necessary for the defined insurance operation, rather than gathering broad histories first.
The question
Under the GDPR in the EEA, an insurer is designing an operations model that needs only customer age band and region. The team proposes collecting full social-media histories before testing necessity. Which action best applies minimization?
Preparing for AIGP? Take the free 5-min readiness quiz →
- Collect histories under a broad purpose, restricting access during development.Access restrictions improve security, but a broad purpose and excessive collection still fail the stated minimization requirement.
- Collect all fields, then remove unnecessary ones after testing.Deleting excess data later does not cure unnecessary initial collection when the stated operational need is already narrow.
- Collect only age band and region, documenting their operational necessity. ✓The stated model need supports collecting the two necessary fields while avoiding unrelated social-media information.
- Collect full histories for future model flexibility.Collecting broad histories without showing necessity conflicts with minimization and purpose-based collection under the GDPR.
The trap
Define the operational need first, then collect the smallest dataset that can support it. How to remember it
Minimization favors collecting only the fields necessary for the defined insurance operation, rather than gathering broad histories first.
How many of these would you get right?
One of 1581 AIGP questions on Certsqill. Take a free five-minute check and see your score per domain — not one number, but which section to open tonight.
Test your AIGP readiness — freeMore Understanding How Laws, Standards and Frameworks Apply to AI questions
- Use the applicable legal-obligation basis: Which conclusion is most supportable? →
- Treat it as personal data because reidentification remains: How should the dataset be treated for the agency’s →
- Classify the provider as controller for its own analytics: Which role best describes that separate activity? →
- All 394 Understanding How Laws, Standards and Frameworks Apply to AI questions →
Part of the Certsqill AIGP question bank · Understanding How Laws, Standards and Frameworks Apply to AI ·
Every answer, right and wrong, comes with its own explanation.