PII and Privacy in the Inbox

1. The real problem: one inbox expands the personal-data surface

When several channels converge into one inbox, names, phone numbers, addresses, free-text bodies and even identity documents can sit together. The risk is not merely that PII exists; it is that fields are copied into search, analytics, dashboards or AI context without a bounded reason. This lesson builds a decision guardrail rather than a vague "private" flag.

2. Lesson boundary and owned artifact

The owned output is Inbox PII Processing & Disclosure Guardrail Matrix v1. For every field it records source, purpose, necessity, access role, disclosure target, redaction or pseudonymization, retention/deletion handling, search scope, AI-context scope, policy version and decision. Executive Docket belongs to PLN-007 and Rolling Planning Horizons belongs to PLN-009.

3. Classify field by field, not message by message

One message can contain both necessary and unnecessary data. A contact name may be needed in an obligation dashboard while an identity-document image is not. The decision unit is therefore the field in a processing context, not an all-or-nothing label on the entire message.

4. Purpose comes before technical access

A downstream use needs a declared, traceable purpose. If purpose is absent, ambiguous or incompatible with the proposed use, technical availability is not enough. Keep the state REVIEW_REQUIRED or BLOCKED until the decisive evidence is visible.

5. Purpose limitation is a legal boundary, not a deployment verdict

GDPR Article 5 says personal data should be collected for specified, explicit and legitimate purposes and not further processed incompatibly with those purposes. This states the legal-principle boundary for processing within GDPR scope; it does not claim that every MAKNOW deployment is subject to GDPR or legally compliant.

6. Data minimisation means only what is necessary

Article 5 also requires personal data to be adequate, relevant and limited to what is necessary for the purpose. In the matrix, necessity is separate from convenience. If an AI drafting feature only needs a non-sensitive obligation summary, sending an identity document merely because it exists in the inbox fails the guardrail.

7. Separate access role from disclosure target

A staff role being allowed to see a field does not automatically authorize sending that field to a search index or AI context. Access Role answers who may see it; Disclosure Target answers where it will go. Both must remain compatible with purpose and necessity.

8. Redaction and pseudonymization reduce exposure

When direct identification is unnecessary, a field can be masked, redacted or replaced by a pseudonymous reference. These techniques do not create authority to process data. They reduce exposure only after purpose and scope are established; unresolved purpose must remain REVIEW_REQUIRED.

9. Keep Search Scope and AI Context Scope independent

A field may be needed in an operational view but inappropriate for a long-lived search index or model prompt context. The matrix must state separately what is searchable and what can enter AI context. "Index everything for convenience" is an invalid shortcut.

10. Retention and deletion are part of the decision

Storage limitation ties retention to the purpose for which data is needed. Record a retention rule, retention-until condition and deletion trigger. If a rule has expired while a derived search copy remains, the decision is BLOCKED until required deletion is evidenced and an audit event is recorded.

11. Policy version and provenance prevent timeless decisions

Every decision should trace to a policy version and visible evidence. If no policy version is available, do not guess ALLOW. REVIEW_REQUIRED means the system is explicitly preserving an unresolved decision boundary.

12. Worked example: minimized dashboard, bounded AI context

Assume the inbox contains contact_name, phone, delivery_address, message_body and identity_document. The dashboard needs only contact_name and obligation_status; AI drafting receives only a non-sensitive obligation summary. identity_document is unnecessary for AI and is BLOCKED. A phone number may remain visible to an authorized role while being excluded or masked in AI context.

13. Keep the three decision states distinct

ALLOW_MINIMIZED means purpose, necessity, role, target and retention evidence are sufficient and only the minimum required fields are disclosed. BLOCKED means a decisive prohibition exists, such as unauthorized role, unnecessary data or expired retention. REVIEW_REQUIRED means decisive purpose, policy or authority evidence is unresolved.

14. Deterministic failure probes

Reject four shortcuts: (1) send an unnecessary identity-document field into AI context; (2) remove the declared purpose while retaining full downstream access; (3) let retention expire while keeping the search-index copy; (4) change the recipient to a role without access while leaving the disclosure plan unchanged. None may silently become ALLOW.

15. Transfer: delete old message bodies, retain a minimal obligation record

In the transfer, old message bodies must be removed from one derived search index while a minimal auditable obligation record remains under a different retention rule. Do not copy the baseline. Recompute allowed fields, search scope, deletion evidence and audit event. The artifact should show what was deleted, what remains, for which purpose and under which visible rule.