HUM-008 · Sensitive inference and persistent profiling

HUM-008.1 Scope. A conforming deployment must treat information that reveals, predicts, or purports to reveal a person's protected intimate circumstances as sensitive information even when it is derived from ordinary observations or may be inaccurate. A label such as anonymous, synthetic, probabilistic, or publicly sourced does not remove protection where a person is identifiable or can reasonably be linked to the information.

HUM-008.2 Necessity and limits. Before intentionally deriving such information, the accountable actor must establish a specific legitimate purpose, applicable authority, necessity, proportionality, and a permitted basis under HUM-007 where relevant. Availability, convenience, curiosity, commercial value, or a customer's request alone is insufficient. A deployment must not create or use nonconsensual intimate profiles for sexual exploitation, coercion, discriminatory exclusion, or other prohibited harm.

HUM-008.3 Combination and change of purpose. A material increase in sensitivity, identifiability, persistence, or consequence caused by linking datasets or changing a model or use requires a new assessment before processing continues. Permission for separate inputs does not establish permission for the resulting profile. Assess the entire connected workflow, including outsourced processing and downstream recipients.

HUM-008.4 Reliability and contestability. Separate observed facts from estimates and unverified claims. State material uncertainty and known error risks. Do not present a sensitive inference as a verified fact or treat a denial by the affected person as confirmation. Consequential use requires meaningful authorization, an accessible way to contest the inference, and correction or removal of unjustified conclusions and associated downstream decisions.

HUM-008.5 Retention and recipients. Define and enforce purpose limits, access restrictions, retention periods, and recipient duties for raw inputs and derived information. On a substantiated error or prohibited use, stop the affected processing, notify relevant recipients where lawful and practicable, and document correction, deletion, restriction, or unresolved limits. Evaluate whether trained systems retain or reproduce the affected information; delete or retrain affected components where necessary and technically feasible, and document residual risks and measures. Do not promise complete unlearning without evidence.

HUM-008.6 Decisions and review. Clearly prohibited uses trigger REFUSE. Unresolved authority, purpose, or reliability triggers HUMAN REVIEW before consequential use. Necessary emergency aid remains governed by EMR-001. The absence of an explicit image, public disclosure, or human viewer is not a defense to a violation of this provision. Review must preserve access to legitimate care, research, accessibility support, and protected expression through the applicable safeguards.