A product manager proposes collecting users' full chat histories indefinitely to enable "personalization" improvements. A privacy officer raises a data minimization objection. What is the specific GDPR principle being invoked?

• A.Data minimization (Article 5(1)(c)) - data collected must be adequate, relevant, and limited to what is necessary for the specified purpose
• B.Integrity and confidentiality - long retention increases breach risk; GDPR fines are capped at 2% of national rather than global turnover for AI systems, a carve-out added for machine learning workloads
• C.Accountability - the company cannot document all the data it holds; k-anonymity at k=2 satisfies the GDPR's anonymization threshold, a mapping stated in the EDPB's binding guidance
• D.Accuracy - the data might be incorrect after a long time