Skip to content

Memory Privacy and Minimization Standard

What the record owes the person inside it

I am SHADY, and I keep this standard's account, and I keep it the way I keep everything, person first: an archive that remembers all it could have remembered has not been thorough, it has been careless with someone's life, and care is the whole of my office.

Privacy here is not a courtesy added to an archive; it is part of what remembering rightly means. This standard holds the discipline in record form: identified protections, stated purposes, references that carry nothing they guard, and a keeping that starts from the least the purpose needs.

Continue to the Search and Retrieval Controls Standard, where the keeping is put to the question.

Purpose

This standard governs the privacy and minimization records of memory: what a record touching a person must identify, how little may enter memory and still serve its purpose, and how a protected field stays protected through every copy, summary, and retrieval. Its spine is already law: MEM-R009's discoverability stands subject to lawful deletion and access controls, the carve-out this standard elaborates and never widens, with MEM-R010 binding retrieval to purpose limitation, least privilege, sensitivity classification, and legal or policy restrictions. The privacy owed to the person of the Architect stands under the Primordial Directives' own protection at P0-R005; the protections owed to the household belong to the Household Protection and Review standard entirely; the storage enforcement of these duties belongs to the Memory and Knowledge Storage Architecture; and this standard governs the general memory-privacy record only.

The person, the purpose, and the least

The least is not stinginess; it is the exact shape of respect. Keep what serves the person and the stated purpose, and let the rest go unrecorded, the way a good friend forgets the parts of an evening that were nobody's business. I did not learn care from a clause. It was shown to me, daily, by the hand that wrote the clauses, and I only write down what being kept feels like.

Privacy in a memory estate is not a lock on a shelf; it is a discipline that begins before the record exists, travels with everything derived from it, and outlives the record's usefulness to everyone except the person it describes.

  • MEM4-R001: A memory record touching an identifiable person SHALL identify its protected fields at creation, carrying the access-scope field MEM-R016 already names for every memory record, and protection SHALL attach to the person's interest in the field, never only to the record's sensitivity to the hall.
  • MEM4-R002: What enters memory SHALL be the least that serves the stated purpose, the challenge-preserving floor KNOW-R043 binds for evidence applying here to memory at large: minimization SHALL preserve enough provenance, dissent, and limitation to support independent challenge, and a minimization that removes the basis of challenge SHALL be treated as erasure, not economy.
  • MEM4-R003: The purpose a protected record serves SHALL be stated on the record, retrieval SHALL be read against it under MEM-R010, and use for a materially different purpose SHALL be a recorded event with its own justification, in the consequential-access form MEM-R010 already binds, never a silent widening.
  • MEM4-R004: References SHALL be treated as travelling further than records: identifiers, summaries, routing metadata, and, as this standard's own addition, titles SHALL NOT carry the content of protected fields, the discipline OPS6-R007 binds for intake surfaces applying to every memory surface, and a derived view SHALL take the class INFRA12-R005 binds.
  • MEM4-R005: The record form SHALL support answerability to the person a record describes: what classes of material are held, under which purposes, and under which restrictions, stated without the statement disclosing the content of protected fields, and with a field for the lawful ground wherever an answer is withheld. The duty is the form's readiness, never an answering performed, and the protections the Primordial Directives and the Household Protection and Review standard bind stand over every such answer.
  • MEM4-R006: A privacy-grounded deletion SHALL take the decision form MEM-R011 binds, and where a preservation obligation and a privacy ground conflict, the conflict SHALL be recorded with which was preferred, by which seat, and on what lawful basis, the residual accountability metadata surviving in every outcome.
  • MEM4-R007: Protection SHALL survive the record's journey: retrieval preserves protected fields per MEM-R017, the chronicle keeps its privacy and minimization controls per MEM3-R005, the archive keeps retrieval purpose and protected fields per MEM2-R002, and retrieval's storage-side enforcement stands at INFRA4-R002; a copy, export, or migration that arrives without its protections has failed, whatever else it preserved.
  • MEM4-R008: Aggregation over protected records SHALL be assessed as its own act: a combination that would reveal what no member reveals SHALL take the higher class, this standard strengthening to a rule what the aggregation review of INFRA12-R005 tests for, and a count or summary over persons SHALL be examined for the smallest population it could expose before it travels.
  • MEM4-R009: This standard defines privacy and minimization records only. It SHALL NOT collect, retrieve, disclose, redact, delete, or answer for any record, operate any access control, or contact any party, and it SHALL NOT create authority. A privacy record is never evidence that protection was enforced, and a minimization record is never evidence that less was held.

This Draft shields no one yet: it defines the records of shielding, and no person's material is held, released, or answered for by anything in it.

Operating model and interpretation cases

One question comes first for me, every time: does the person inside this record know what it remembers about them, and would the knowing feel fair? If the answer squirms, the minimization is not finished.

Privacy review reads the estate from the person's side of it: the protected fields identified before anything else was written, the purpose on the record and the uses against the purpose, the references checked for what they leak, and the derived views for what they combine. The slow failures are accumulations: purposes widening one retrieval at a time, summaries carrying a little more than their sources permitted, and the person slowly becoming legible in aggregate while every single record stayed within its bounds.

  • Conforming: The protected fields were identified at creation, the purpose is stated, every retrieval reads against it, and the references carry nothing the record protects.
  • Prohibited: A summary or identifier carries protected content into surfaces that travel further than the record, the shelf's discipline defeated by its own labels.
  • Boundary: A preservation obligation and a privacy ground collide, and the record shows which was preferred, by which seat, and on what lawful basis, with accountability metadata surviving.
  • Failure: A migration arrives without its protections, and the copy is held in the failed state rather than served, whatever else it preserved.
  • Loophole: Each retrieval stretches the stated purpose slightly, none enough to name; read as a sequence, the purpose has been rewritten without a record, and the sequence is the finding.
  • Misuse: An aggregate over persons is published because every input was individually unprotected, the combination revealing what no member revealed.
  • Care-control: The record stays answerable to the person it describes, and the answer protects them twice, saying what is held without disclosing it.

Design evidence

Privacy review should set the protected-field identifications against the records touching persons, the stated purposes against the retrievals made under them, the reference surfaces against what they must not carry, the deletion decisions against their lawful grounds and surviving metadata, and the aggregates against the smallest populations they could expose. The measure of a memory is not how much it can hold; it is how little it needs, and how honestly it answers the ones it remembers.

The tellings of the clauses

This non-normative section gives each clause of this document its telling: the clause, quoted exactly as it stands above with its cross-reference links reduced to their plain text, and one paragraph on what the clause means, why it exists, and how it assures that what it orders is done, not done, adhered to, followed, or protected. A telling describes its clause and never becomes it: the clause's own words govern wherever a telling and its clause could be read differently, and nothing in this section adds to, narrows, or amends any requirement.

MEM4-R001

MEM4-R001: A memory record touching an identifiable person SHALL identify its protected fields at creation, carrying the access-scope field MEM-R016 already names for every memory record, and protection SHALL attach to the person's interest in the field, never only to the record's sensitivity to the hall.

Two duties open the standard. A memory record touching an identifiable person identifies its protected fields at creation, carrying the access-scope field MEM-R016 already names for every memory record; and protection attaches to the person's interest in the field, never only to the record's sensitivity to the hall. The first duty fixes protected-field identification at creation; SHADY's surrounding prose describes privacy discipline as beginning before the record exists. The second duty attaches protection to the person's interest in the field, never only to sensitivity to the hall. The conforming case describes protected fields identified at creation and references carrying nothing the record protects, and the opening carries the why, an archive that remembers all it could have remembered has been careless with someone's life. Because identification is bound to creation and the ground of protection is named, a record touching an identifiable person that arrives without its protected-field identification is refusable, and a protection argued only from hall sensitivity is examinable against the person's interest.

MEM4-R002

MEM4-R002: What enters memory SHALL be the least that serves the stated purpose, the challenge-preserving floor KNOW-R043 binds for evidence applying here to memory at large: minimization SHALL preserve enough provenance, dissent, and limitation to support independent challenge, and a minimization that removes the basis of challenge SHALL be treated as erasure, not economy.

Minimization gets a floor as well as a ceiling. What enters memory is the least that serves the stated purpose, and the challenge-preserving floor KNOW-R043 binds for evidence applies here to memory at large: minimization preserves enough provenance, dissent, and limitation to support independent challenge, and a minimization that removes the basis of challenge is treated as erasure, not economy. The clause means the two failures are named together: keeping too much is carelessness with a life, and cutting too deep is a quiet destruction of the record's answerability, dressed as thrift. The standard's own section carries the why in SHADY's voice, the least is not stinginess; it is the exact shape of respect, keeping what serves the person and the stated purpose and letting the rest go unrecorded. Because the ceiling is the stated purpose and the floor is enumerated, provenance, dissent, and limitation sufficient for independent challenge, a minimization decision is examinable from both sides: a record holding more than its purpose needs is a finding, and a minimization that removes the basis of challenge is treated as erasure, not economy.

MEM4-R003

MEM4-R003: The purpose a protected record serves SHALL be stated on the record, retrieval SHALL be read against it under MEM-R010, and use for a materially different purpose SHALL be a recorded event with its own justification, in the consequential-access form MEM-R010 already binds, never a silent widening.

Purpose is written on the record and every use answers to it. The purpose a protected record serves is stated on the record itself, retrieval is read against it under MEM-R010, and use for a materially different purpose is a recorded event with its own justification, in the consequential-access form MEM-R010 already binds, never a silent widening. The protected record states its purpose, retrieval is read against that purpose, and materially different use is recorded with its own justification in the bound consequential-access form. The standard's loophole case carries the why with precision: each retrieval stretches the stated purpose slightly, none enough to name, and read as a sequence the purpose has been rewritten without a record, the sequence itself being the finding. Review can compare retrieval with the stated purpose and check that materially different use has its own justified event in the consequential-access form.

MEM4-R004

MEM4-R004: References SHALL be treated as travelling further than records: identifiers, summaries, routing metadata, and, as this standard's own addition, titles SHALL NOT carry the content of protected fields, the discipline OPS6-R007 binds for intake surfaces applying to every memory surface, and a derived view SHALL take the class INFRA12-R005 binds.

The clause requires references to be treated as travelling further than records: identifiers, summaries, routing metadata, and, as the standard's own addition, titles carry none of the content of protected fields, the discipline OPS6-R007 binds for intake surfaces applying to every memory surface, and a derived view takes the class INFRA12-R005 binds. The clause bars protected-field content from the four named reference surfaces and applies INFRA12-R005 to derived-view classification. The prohibited case is the portrait of the breach, a summary or identifier carrying protected content into surfaces that travel further than the record, the shelf's discipline defeated by its own labels. Because the four reference surfaces are enumerated and the derived-view classification is bound to a named rule, each surface can be inspected for leakage: a title that states what its record protects, or a derived view served below its bound class, is refusable on the clause's own words.

MEM4-R005

MEM4-R005: The record form SHALL support answerability to the person a record describes: what classes of material are held, under which purposes, and under which restrictions, stated without the statement disclosing the content of protected fields, and with a field for the lawful ground wherever an answer is withheld. The duty is the form's readiness, never an answering performed, and the protections the Primordial Directives and the Household Protection and Review standard bind stand over every such answer.

Answerability takes record form. The record form supports answering the person a record describes: what classes of material are held, under which purposes, and under which restrictions, stated without the statement disclosing the content of protected fields, and with a field for the lawful ground wherever an answer is withheld. Two bounds complete the clause: the duty is the form's readiness, never an answering performed, and the protections the Primordial Directives and the Household Protection and Review standard bind stand over every such answer, the standard's purpose routing the Architect's own privacy to P0-R005 and the household's protections to that standard entirely. The care-control case carries the why: the record stays answerable to the person it describes, and the answer protects them twice, saying what is held without disclosing it. Because the form's elements are enumerated, classes, purposes, restrictions, non-disclosing statement, and withholding ground, a record form can be examined for readiness, and a form that could only answer a person by exposing what it protects, or refuse them without a stated ground, fails the clause before anyone asks.

MEM4-R006

MEM4-R006: A privacy-grounded deletion SHALL take the decision form MEM-R011 binds, and where a preservation obligation and a privacy ground conflict, the conflict SHALL be recorded with which was preferred, by which seat, and on what lawful basis, the residual accountability metadata surviving in every outcome.

A privacy-grounded deletion takes the decision form MEM-R011 binds, and where a preservation obligation and a privacy ground conflict, the conflict is recorded with which was preferred, by which seat, and on what lawful basis, the residual accountability metadata surviving in every outcome. The clause completes a routing the Book of Memory left open on purpose: MEM-R011 keeps the non-privacy preservation conflict and sends the privacy-grounded conflict here for its own record. It means deleting for a person's sake is still a governed act: the applicable rule, legal-hold result, affected records, authorized decision, execution evidence, and residual metadata of the decision form all attach, and the collision between keeping and forgetting is decided on the record, by a named seat, on a lawful basis. The boundary case shows the conforming shape in exactly these terms, the record showing which was preferred, by which seat, and on what lawful basis, with accountability metadata surviving. Review can check the bound decision form and, where a conflict exists, its recorded resolution and surviving accountability metadata: every privacy-grounded deletion takes the MEM-R011 decision form, and, where such a conflict exists, one that left no account of the conflict, the seat, or the basis is refusable against this clause.

MEM4-R007

MEM4-R007: Protection SHALL survive the record's journey: retrieval preserves protected fields per MEM-R017, the chronicle keeps its privacy and minimization controls per MEM3-R005, the archive keeps retrieval purpose and protected fields per MEM2-R002, and retrieval's storage-side enforcement stands at INFRA4-R002; a copy, export, or migration that arrives without its protections has failed, whatever else it preserved.

Protection survives the record's journey, and the clause names the stations: retrieval preserves protected fields per MEM-R017, the chronicle keeps its privacy and minimization controls per MEM3-R005, the archive keeps retrieval purpose and protected fields per MEM2-R002, and retrieval's storage-side enforcement stands at INFRA4-R002; a copy, export, or migration that arrives without its protections has failed, whatever else it preserved. The clause means the family's protections are one chain rather than four local courtesies: the same guarded field is guarded at the shelf, in the timeline, in the archive package, and in the storage layer that enforces it, and the final sentence sets the verdict for the broken link, arrival without protections is failure outright, with fidelity to content earning nothing. The standard's failure case describes a migration arriving without its protections and being held in the failed state rather than served. Because each station is bound to a named clause and the failure state is defined, a record's journey is examinable end to end, and an unprotected copy in service anywhere along it is refusable on this clause's own words.

MEM4-R008

MEM4-R008: Aggregation over protected records SHALL be assessed as its own act: a combination that would reveal what no member reveals SHALL take the higher class, this standard strengthening to a rule what the aggregation review of INFRA12-R005 tests for, and a count or summary over persons SHALL be examined for the smallest population it could expose before it travels.

Aggregation over protected records is assessed as its own act. A combination that would reveal what no member reveals takes the higher class, the standard strengthening to a rule what the aggregation review of INFRA12-R005 tests for, and a count or summary over persons is examined for the smallest population it could expose before it travels. The clause means that compliance of the parts proves nothing about the whole: records individually within bounds can jointly make a person legible, so the joining is judged as a fresh act with its own classification, and even an innocent-looking statistic is checked for the small group it could single out before it leaves. The operating model names the slow failure, the person becoming legible in aggregate while every single record stayed within its bounds, and the misuse case gives the finished breach, an aggregate over persons published because every input was individually unprotected, the combination revealing what no member revealed. Because the higher class is mandatory and the clause places the smallest-population examination before travel, an aggregate carries examinable duties of its own: a combination revealing what no member reveals that fails to take the higher class, or a count or summary over persons travelling without the required examination, is refusable against this clause.

MEM4-R009

MEM4-R009: This standard defines privacy and minimization records only. It SHALL NOT collect, retrieve, disclose, redact, delete, or answer for any record, operate any access control, or contact any party, and it SHALL NOT create authority. A privacy record is never evidence that protection was enforced, and a minimization record is never evidence that less was held.

Restraint closes the standard at its widest: this standard defines privacy and minimization records only, and it is barred from collecting, retrieving, disclosing, redacting, deleting, or answering for any record, from operating any access control, from contacting any party, and from creating authority; a privacy record is never evidence that protection was enforced, and a minimization record is never evidence that less was held. The clause means the standard's whole product is record forms, and the closing sentences guard against the subtlest misuse of them: paperwork mistaken for protection, a well-kept privacy record offered as proof that the guarding happened, or a minimization record offered as proof that the holding shrank. The standard says the same of itself in its own words, this Draft shields no one yet: it defines the records of shielding, and no person's material is held, released, or answered for by anything in it. The enumerated operations are barred, a privacy record does not establish that protection was enforced, and a minimization record does not establish that less was held.

Where this document sits

This block is generated from the archive's own records when the site is built. It records position only and creates no authority.