Privacy protection
This group represents almost 14% of the articles and focuses on two primary issues related to privacy.
ENTITY
3 - Other
INTENT
3 - Other
TIMING
3 - Other
Risk ID
mit584
Domain lineage
2. Privacy & Security
2.1 > Compromise of privacy by leaking or correctly inferring sensitive information
Mitigation strategy
1. Enforce Data Minimization and Privacy-by-Design principles throughout the AI system lifecycle, ensuring the collection, processing, and retention of personal and sensitive data are strictly limited to necessary, specified, and consented purposes. This foundational control must be supported by automated data discovery and classification mechanisms to accurately identify all sensitive inputs. 2. Apply robust multi-layered access controls and cryptographic techniques. This mandates Role-Based Access Control (RBAC) guided by the Principle of Least Privilege, coupled with high-strength encryption (e.g., AES-256 for data-at-rest and TLS/SSL for data-in-transit) for all datasets used in AI training, operation, and storage. 3. Implement continuous monitoring via Data Loss Prevention (DLP) solutions to detect and automatically prevent unauthorized data exfiltration or transfer. Concurrently, mandate Privacy Impact Assessments (PIAs) or Data Protection Impact Assessments (DPIAs) to systematically evaluate and mitigate privacy risks, including the potential inference of sensitive information from non-sensitive data, prior to model deployment.