The principle of data minimization aims to reduce the amount of data
collected, processed or retained to minimize the potential for misuse,
unauthorized access, or data breaches. Rooted in privacy-by-design principles,
data minimization has been endorsed by various global data protection
regulations. However, its practical implementation remains a challenge due to
the lack of a rigorous formulation. This paper addresses this gap and
introduces an optimization framework for data minimization based on its legal
definitions. It then adapts several optimization algorithms to perform data
minimization and conducts a comprehensive evaluation in terms of their
compliance with minimization objectives as well as their impact on user
privacy. Our analysis underscores the mismatch between the privacy expectations
of data minimization and the actual privacy benefits, emphasizing the need for
approaches that account for multiple facets of real-world privacy risks.

基于法律定义，本文介绍了数据最小化的优化框架，并使用多个优化算法来实现数据最小化，通过对合规性和用户隐私影响的全面评估，我们的分析强调了数据最小化的隐私预期与实际隐私利益之间的不匹配，强调了需要考虑现实世界隐私风险的多个方面的方法的需求。