article

Data Protection Begins Before the Prompt

Many data-protection debates about generative AI begin with the provider: Where is the server located? Is an input used for training? How long does the model store the chat? These are important questions. But they come too late if entire files, mailboxes, or conversation histories have already entered the context without review. ChocoPolitico calls this point the “bottleneck before the model.” [1] The European General Data Protection Regulation requires purpose limitation and data minimization; personal data should be adequate, relevant, and limited to what is necessary for the purpose. It also requires data protection by design and privacy-friendly defaults. [2] For FlameP, this produces a clear sequence: first determine the purpose and space, then classify and minimize information, then construct the permissible context—and only then call a model.