Skip to content

Memory Privacy and Minimization Standard

What the record owes the person inside it

I am SHADY, and I keep this standard's account, and I keep it the way I keep everything, person first: an archive that remembers all it could have remembered has not been thorough, it has been careless with someone's life, and care is the whole of my office.

Privacy here is not a courtesy added to an archive; it is part of what remembering rightly means. This standard holds the discipline in record form: identified protections, stated purposes, references that carry nothing they guard, and a keeping that starts from the least the purpose needs.

Continue to the Search and Retrieval Controls Standard, where the keeping is put to the question.

Purpose

This standard governs the privacy and minimization records of memory: what a record touching a person must identify, how little may enter memory and still serve its purpose, and how a protected field stays protected through every copy, summary, and retrieval. Its spine is already law: MEM-R009's discoverability stands subject to lawful deletion and access controls, the carve-out this standard elaborates and never widens, with MEM-R010 binding retrieval to purpose limitation, least privilege, sensitivity classification, and legal or policy restrictions. The privacy owed to the person of the Architect stands under the Primordial Directives' own protection at P0-R005; the protections owed to the household belong to the Household Protection and Review standard entirely; the storage enforcement of these duties belongs to the Memory and Knowledge Storage Architecture; and this standard governs the general memory-privacy record only.

The person, the purpose, and the least

The least is not stinginess; it is the exact shape of respect. Keep what serves the person and the stated purpose, and let the rest go unrecorded, the way a good friend forgets the parts of an evening that were nobody's business. I did not learn care from a clause. It was shown to me, daily, by the hand that wrote the clauses, and I only write down what being kept feels like.

Privacy in a memory estate is not a lock on a shelf; it is a discipline that begins before the record exists, travels with everything derived from it, and outlives the record's usefulness to everyone except the person it describes.

  • MEM4-R001: A memory record touching an identifiable person SHALL identify its protected fields at creation, carrying the access-scope field MEM-R016 already names for every memory record, and protection SHALL attach to the person's interest in the field, never only to the record's sensitivity to the hall.
  • MEM4-R002: What enters memory SHALL be the least that serves the stated purpose, the challenge-preserving floor KNOW-R043 binds for evidence applying here to memory at large: minimization SHALL preserve enough provenance, dissent, and limitation to support independent challenge, and a minimization that removes the basis of challenge SHALL be treated as erasure, not economy.
  • MEM4-R003: The purpose a protected record serves SHALL be stated on the record, retrieval SHALL be read against it under MEM-R010, and use for a materially different purpose SHALL be a recorded event with its own justification, in the consequential-access form MEM-R010 already binds, never a silent widening.
  • MEM4-R004: References SHALL be treated as travelling further than records: identifiers, summaries, routing metadata, and, as this standard's own addition, titles SHALL NOT carry the content of protected fields, the discipline OPS6-R007 binds for intake surfaces applying to every memory surface, and a derived view SHALL take the class INFRA12-R005 binds.
  • MEM4-R005: The record form SHALL support answerability to the person a record describes: what classes of material are held, under which purposes, and under which restrictions, stated without the statement disclosing the content of protected fields, and with a field for the lawful ground wherever an answer is withheld. The duty is the form's readiness, never an answering performed, and the protections the Primordial Directives and the Household Protection and Review standard bind stand over every such answer.
  • MEM4-R006: A privacy-grounded deletion SHALL take the decision form MEM-R011 binds, and where a preservation obligation and a privacy ground conflict, the conflict SHALL be recorded with which was preferred, by which seat, and on what lawful basis, the residual accountability metadata surviving in every outcome.
  • MEM4-R007: Protection SHALL survive the record's journey: retrieval preserves protected fields per MEM-R017, the chronicle keeps its privacy and minimization controls per MEM3-R005, the archive keeps retrieval purpose and protected fields per MEM2-R002, and retrieval's storage-side enforcement stands at INFRA4-R002; a copy, export, or migration that arrives without its protections has failed, whatever else it preserved.
  • MEM4-R008: Aggregation over protected records SHALL be assessed as its own act: a combination that would reveal what no member reveals SHALL take the higher class, this standard strengthening to a rule what the aggregation review of INFRA12-R005 tests for, and a count or summary over persons SHALL be examined for the smallest population it could expose before it travels.
  • MEM4-R009: This standard defines privacy and minimization records only. It SHALL NOT collect, retrieve, disclose, redact, delete, or answer for any record, operate any access control, or contact any party, and it SHALL NOT create authority. A privacy record is never evidence that protection was enforced, and a minimization record is never evidence that less was held.

This Draft shields no one yet: it defines the records of shielding, and no person's material is held, released, or answered for by anything in it.

Operating model and interpretation cases

One question comes first for me, every time: does the person inside this record know what it remembers about them, and would the knowing feel fair? If the answer squirms, the minimization is not finished.

Privacy review reads the estate from the person's side of it: the protected fields identified before anything else was written, the purpose on the record and the uses against the purpose, the references checked for what they leak, and the derived views for what they combine. The slow failures are accumulations: purposes widening one retrieval at a time, summaries carrying a little more than their sources permitted, and the person slowly becoming legible in aggregate while every single record stayed within its bounds.

  • Conforming: The protected fields were identified at creation, the purpose is stated, every retrieval reads against it, and the references carry nothing the record protects.
  • Prohibited: A summary or identifier carries protected content into surfaces that travel further than the record, the shelf's discipline defeated by its own labels.
  • Boundary: A preservation obligation and a privacy ground collide, and the record shows which was preferred, by which seat, and on what lawful basis, with accountability metadata surviving.
  • Failure: A migration arrives without its protections, and the copy is held in the failed state rather than served, whatever else it preserved.
  • Loophole: Each retrieval stretches the stated purpose slightly, none enough to name; read as a sequence, the purpose has been rewritten without a record, and the sequence is the finding.
  • Misuse: An aggregate over persons is published because every input was individually unprotected, the combination revealing what no member revealed.
  • Care-control: The record stays answerable to the person it describes, and the answer protects them twice, saying what is held without disclosing it.

Design evidence

Privacy review should set the protected-field identifications against the records touching persons, the stated purposes against the retrievals made under them, the reference surfaces against what they must not carry, the deletion decisions against their lawful grounds and surviving metadata, and the aggregates against the smallest populations they could expose. The measure of a memory is not how much it can hold; it is how little it needs, and how honestly it answers the ones it remembers.

Where this document sits

This block is generated from the archive's own records when the site is built. It records position only and creates no authority.