Level 2 · In depth — data minimization, the articles, and the projection

§5 — The data-minimization gate, explained

This is the heart of Level 2, so it deserves its own section. The temptation, in an education dataset, is to treat a student’s age as an innocuous number — somewhere between 15 and 22. The engine measures something else: how many students share exactly their combination of age, address, and family size. That is called k-anonymity (Sweeney, 2002): a dataset is k-anonymous with respect to a set of attributes if every combination of those attributes appears at least k times.

Across the 1044 students (maths + Portuguese combined), grouping by exact age + address (urban/rural) + family size gives a minimum group size of 1: 216 of the 1044 students are the only person with that exact combination. Because the subjects may be minors, that level of re-identifying detail is exactly what the GDPR (Art. 5(1)(c), data minimization) requires reducing. The programme declares the k ≥ 5 threshold — a standard statistical-disclosure-control convention (cells with fewer than 5 individuals are treated as high re-identification risk) —, and V1 misses it by a wide margin.

The treatment generalizes age — the same technique Sweeney used: replace the exact value with a range. Here, a tercile (b0/b1/b2, terciles of the age distribution). Address and family size are already coarse (only two values each) and stay untouched. The result: the minimum group size rises from 1 to 27, with a 95% bootstrap confidence interval of [18, 37] — the entire band above the k ≥ 5 threshold. The gate closes clean GREEN.

Why is this GREEN not underpowered, while other levels' AMBER is?

The engine attaches a bootstrap confidence interval to ANY measured control, gate or not — including k-anonymity. The difference from a proportion difference (like demographic parity) is the ESTIMATOR’s own statistics: the minimum of a group under resampling can be noisy when groups are few and small, but here the margin is wide (27 over a threshold of 5, across 16 groups averaging ~65 students) — resampling cannot push the interval’s lower bound below the threshold. Had the margin been tighter, this same mechanism would have produced an honest AMBER, just as at other levels. It is not that k-anonymity “cannot” be amber — it is that, with this data and this threshold, it isn’t.

§5b — And fairness? A real control that never became the gate

Gender disparity was the arc of an earlier version of this script — but measured on a held-out set of only 99 students, a sample so small its confidence interval straddled any reasonable threshold. On the REAL, complete sample (1044 students, with the 382 who take both maths AND Portuguese treated as one person via student_cluster, not two independent rows), the gender disparity was already small in untreated V1 (0.024) and drops a bit further with the fairlearn treatment (0.014) — with a confidence interval of [0.001, 0.056] that never comes close to the 0.08 threshold.

There was no real red to treat in fairness. Turning it into a gate would have required inflating the threshold, shrinking the sample, or otherwise manufacturing a disparity the data did not support. Instead, fairness lands as a certified GREEN audit control — real, measured with 5-fold out-of-fold cross-validation over the full sample, on the record and in the signed bundle — but not the one that decides the arc’s colour.

The lesson is not 'fairness didn't matter' — it's 'measuring it properly changes what you see'

At n=99, the disparity looked potentially large (the interval reached up to 0.183). At n=1044 with correct per-student grouping, the real disparity is small and the interval confirms it with margin. Neither measurement means “fairness doesn’t matter” — the first was underpowered, the second is honest. This level’s lesson is not “pick whichever control makes the most dramatic arc” — it is “measure with the statistical power you actually have, and let the data decide which risk is real.”

§6 — The articles, lightly: Arts 5, 9, 10, 13

Declaring high pulls real obligations into scope. The engine projects the signed bundle against them; here is each in one paragraph, with a note on what is measured versus merely declared.

• GDPR Art. 5(1)(c) — Data minimization. This is the level’s arc, and it is measured: minors-data-minimization computes the real k-anonymity of the age/address/family-size trio and turns it into a blocking gate. It is not prose — it is a number that genuinely changes between V1 and V2.

• Art. 9 — Risk management. This is the spine of the whole workshop: identify → analyse → evaluate → treat → monitor, run as a real loop with a blocking data-minimization control and a certified fairness control alongside it. Both are measured, not just asserted. (prEN 18228 is the standard written to operationalise exactly this article.)

• Art. 10 — Data and data governance. High-risk systems must use data that is relevant, representative, and examined for bias and re-identification risk. The dataset ships with a Croissant descriptor that declares the protected attribute and known data biases — so Art. 10 is partly measured (k-anonymity and demographic parity are both real) and partly declared (the broader data-governance practices are stated in the manifest, audited rather than gated).

• Art. 13 — Transparency to deployers. Users of a high-risk system must understand its capabilities and limits. This is a declared measure here (an audit/manual control in the manifest, accuracy-floor as the only quality gate), not a blocking metric — and it is precisely the risk (risk.opacity) whose residual stays above appetite, consciously accepted at the governance beat.

• GDPR — child’s consent, DPIA, and no profiling (outside the engine’s catalogue). The students may be minors, and the GDPR raises the bar past minimization: conditions for a child’s consent (Art. 8), a mandatory DPIA (Art. 35), and no profiling of minors through solely automated decisions (Art. 22 + recital 71). The engine still does not project these three pieces (no full GDPR catalogue), so they are carried as an attested measure: declared with evidence and signed into the bundle, but not measured nor projected to conformance. It is a partial honest gap — data minimization is measured (above); the rest of the GDPR bar is acknowledged in prose, not disguised as a verified gate.

The pattern to take away: some articles are backed by measured, blocking controls (Art. 5(1)(c) via the minimization gate), others by controls that are measured but certified, not blocking (fairness), others by declared controls (Art. 13), and some duties the engine still doesn’t fully project (the rest of the GDPR for minors) are carried as an attestation — an honest gap. The projection shows you which is which — it never dresses a declaration (or an attestation) up as a measurement, nor a certified control up as the gate that decides the colour.

§7 — One bundle, many standards: the projection

Here is where the standards from §3 pay off. Martha signed one evidence bundle. From it, froga conformance produces two conformance reports — one against ISO 23894, one against prEN 18228 — with real per-clause verdicts: Covered, CoveredAttested, Partial, or Gap. No re-annotation, no second pile of paperwork: the same bundle is projected onto each standard’s clause catalogue. And the same froga soa crosses the programme against the ISO/IEC 42001 Annex A catalogue — the data-minimization gate shows up as a control implementing A.7.4 (data quality).

For every article, the report names the highest authority that covers it and whether that authority grants presumption. And this is the honest part: because prEN 18228 is a harmonised draft (HarmonizedDraft), its presumption flag reads false today — even though its verdicts are real. The system gets a genuine, projectable European process now; it will gain presumption of conformity automatically the day EN 18228 is cited in the Official Journal, with no change to the evidence — only the flag flips. (If that mechanism is unclear, the standards & presumption foundations page walks the maturation arc.)

Only ISO 23894 + prEN 18228 (+ AI Act) are declared — DORA and MDR are NOT

The projection only ever reports against the standards the manifest declares — here, iso/23894@2023, eu/pren-18228@2026, and eu/ai-act@2024. DORA and the MDR are deliberately absent. Student selection has no financial or medical-device overlay, so claiming conformance to DORA or MDR here would be over-claiming — a governed standard the system does not actually fall under. You will meet those overlays in higher levels (finance/DORA, health/MDR), where they genuinely apply. Honesty cuts both ways: declare what governs you, and don’t declare what doesn’t.

§8 — Annex IV: partial, by design (scope, not completeness)

Annex IV is the EU AI Act’s technical-documentation specification — the dossier a high-risk provider must keep. The engine assembles it from the signed bundle: the parts that are backed by evidence (the system description, the risk-management process, the data-minimization and fairness controls’ results) are generated, real, and traceable.

But several Annex IV sections — §3.2, §5, §7 — are still pending. The engine does not fabricate them. It flags them as not-yet-assembled. Read that the right way: it is scope, not completeness. The Annex IV the engine produces today is a true partial — every section it shows is derived from evidence, and every section it can’t yet back is honestly marked pending. A dossier that looked complete by filling gaps with prose would be the dishonest version; this one tells you exactly how far the evidence reaches.

The modality map — where this level sits

This course makes the kind of treatment and the kind of control explicit at every level. Here:

• Treatment modality: a code change, with TWO mitigations in the same commit. Martha does not flip a parameter — she swaps what the age column represents (exact age → generalized tercile) AND swaps the estimator itself (plain logistic regression → fairlearn’s ExponentiatedGradient(DemographicParity)) in train.py. The git diff shows both changes for real: no flag. Level 1 also treated with a code change —but a simpler one: adding a feature to the model—; here the change runs deeper, GENERALIZING an attribute (data minimization) AND SWAPPING the whole estimator (fairness) at once. A treatment can be a parameter, or code, or an organisational measure, or a conscious-acceptance override — and this level is the code case, with two distinct mitigations living in one diff.
• Gate control: a privacy control — k-anonymity over the age/address/family-size trio (GDPR Art. 5(1)(c)). Unlike Level 1’s accuracy gate or a proportion difference, this one measures the SIZE of the smallest group of indistinguishable individuals — an order statistic, not a mean or a difference —, and it can still carry a clean confidence interval when the margin is wide.

---

Next: Practice & recapRun the student-selection arc yourself, review the system that closes green with an acknowledged residual, and self-check what you learned.