The problem is the existence of Personally Identifiable Information (PII) within the customer feedback data, which introduces privacy risks for the development and training of the generative AI model. The goal is to mitigate these risks before using the data to train the AI model.
According to Google's Responsible AI and data handling best practices, when sensitive data like PII is present in a dataset intended for model training, the most critical step to prioritize is data minimization and privacy protection at the source. This is often achieved through anonymization or de-identification.
Applying data anonymization techniques (D) directly addresses the risk by removing or obscuring the sensitive data elements. This prevents the PII from being embedded into the model's parameters during training, thereby eliminating the risk of data leakage or privacy violations in the AI application's outputs. This is a crucial early step in the ML lifecycle for datasets containing sensitive information.
Option C, implementing access controls, is a necessary security measure but is a reactive control that protects the raw data; it does not remove the PII risk from the derived model itself. Option A is a long-term change to data collection but doesn't solve the problem for the existing data. Option B relates to bias and accuracy, not specifically PII risk mitigation.
(Reference: Google Cloud's Secure AI Framework (SAIF) and Responsible AI principles emphasize protecting sensitive data at all stages of the ML lifecycle, with de-identification being the primary method before training.)