Which practice is emphasized by GDPR/CCPA for AI-based performance appraisal?

Which practice is emphasized by GDPR/CCPA for AI-based performance appraisal?

• A. Data minimization
• B. Data hoarding
• C. No consent required
• D. Anonymous-only data

Answer: (A)

Data minimization is the guiding principle here. In GDPR and CCPA, the idea is to collect and process only what is strictly necessary to achieve the stated purpose, and to avoid gathering data just because it might be useful later. For AI-based performance appraisal, this means you should obtain only the data that directly informs evaluating an employee’s performance—things like objective work outputs, relevant feedback, and role-related metrics—and avoid extra personal or sensitive information unless you have a clear, lawful justification to use it and a legitimate need tied to the appraisal. This approach reduces privacy risks, makes compliance easier to justify to data subjects and regulators, and helps prevent oversharing or misuse of data. It also supports better governance of AI systems, since the model is trained and evaluated on the smallest necessary dataset, which can also mitigate bias that might creep in from extraneous data. Choosing data hoarding would run counter to this principle, as collecting more data than necessary increases risk and complexity. The idea that no consent is required is inaccurate under GDPR/CCPA, which require lawful basis—often consent or another justification—for processing personal data. Finally, processing data that is strictly anonymous might seem protective, but performance appraisal typically needs identifiable data to tie the evaluation to a specific employee, and true anonymity can be impractical or degrade accountability; regulations still expect careful consideration of what data is necessary and how it’s used.

Data minimization is the guiding principle here. In GDPR and CCPA, the idea is to collect and process only what is strictly necessary to achieve the stated purpose, and to avoid gathering data just because it might be useful later. For AI-based performance appraisal, this means you should obtain only the data that directly informs evaluating an employee’s performance—things like objective work outputs, relevant feedback, and role-related metrics—and avoid extra personal or sensitive information unless you have a clear, lawful justification to use it and a legitimate need tied to the appraisal.

This approach reduces privacy risks, makes compliance easier to justify to data subjects and regulators, and helps prevent oversharing or misuse of data. It also supports better governance of AI systems, since the model is trained and evaluated on the smallest necessary dataset, which can also mitigate bias that might creep in from extraneous data.

Choosing data hoarding would run counter to this principle, as collecting more data than necessary increases risk and complexity. The idea that no consent is required is inaccurate under GDPR/CCPA, which require lawful basis—often consent or another justification—for processing personal data. Finally, processing data that is strictly anonymous might seem protective, but performance appraisal typically needs identifiable data to tie the evaluation to a specific employee, and true anonymity can be impractical or degrade accountability; regulations still expect careful consideration of what data is necessary and how it’s used.