Preserve purpose integrity by restricting unnecessary or unauthorized secondary use, profiling, repurposing, or reuse of data beyond the function for which it was legitimately processed.
Zero Exploitation is the principle of restricting unnecessary or unauthorized secondary use of data beyond a defined and legitimate purpose.
It focuses on purpose integrity: data should not quietly become a reusable asset for unrelated profiling, targeting, resale, model enrichment, or analytics simply because it is available.
Policies matter, but architecture can make unauthorized secondary use harder by constraining access paths, data flows, and retention.
| Open-ended reuse pattern | Zero Exploitation orientation |
|---|---|
| Collected once, reused broadly | Use restricted to a defined purpose |
| Secondary analytics added later | Secondary use requires explicit justification and controls |
| Profiles become reusable assets | Reduce the system’s dependence on reusable personal profiles |
| Access expands over time | Scope access to the minimum functional context |
Use role, service, and workflow controls so data is available only where the defined function requires it.
Review APIs, analytics, vendors, model pipelines, and integrations so secondary systems do not quietly create new uses.
Zero Exploitation discourages unnecessary behavioral profiling or targeting built from data collected for another purpose.
Bias, proxy variables, model behavior, and deployment context may still create discrimination or misuse even when direct identifiers are limited.
No. Secondary use may be legitimate when it is properly defined, authorized, expected, and supported by appropriate controls.
No. ZDP treats purpose limitation as an architectural concern too, using access, workflow, integration, and retention controls to reduce function creep.
No. Proxy variables, biased datasets, model behavior, and deployment context can still create discrimination or misuse.
The three principles reinforce each other: collect less unnecessary data, retain less unnecessary data, and restrict unnecessary secondary use.
ZDP treats collection, retention, and exploitation as connected architectural questions. Each pillar should be evaluated in context rather than as an isolated compliance promise.