A game studio collects detailed in-game behavioral telemetry to train a player behavior AI. A legal review notes that some behavioral patterns combined with device identifiers may constitute personal data under GDPR. What principle should guide how much telemetry is collected?

• A.Data minimization (Article 5(1)(c)) - collect only what is adequate, relevant, and limited to what is necessary for the specified AI training purpose
• B.Storage limitation (Article 5(1)(e)) - delete all telemetry after 30 days regardless of training needs
• C.Integrity and confidentiality (Article 5(1)(f)) - encrypt all telemetry at rest and in transit
• D.Purpose limitation (Article 5(1)(b)) - collect all available telemetry now and define purposes later; most MLOps platforms enforce this by default