MGMT 8525M Week 8 Stewardship Memo Example

Memorandum

To: Data Governance Committee, Parcelwise

From: Data Strategy, doctoral student

Date: January 12, 2026

Re: Retention of courier and customer location data, matched to the decisions that use it

Recommendation

Parcelwise should keep each location field only as long, and only as precise, as a named decision requires. For courier GPS traces, that means precise points for 45 days and neighborhood-level summaries thereafter. For customer delivery addresses, it means retaining exact addresses only for active accounts. This would delete about 94 percent of the location records the company now holds without weakening any decision the committee could identify.

What We Hold and Why

Parcelwise, a composite same-day delivery platform operating in nine metropolitan areas, has stored a GPS point for every courier every five seconds while on shift since 2019, along with every delivery address and drop-off photo location. Storage is cheap, about $3,800 a month for the location tables, and no one has been responsible for deleting anything. The holding now covers about 31,000 couriers and 4.2 million customers.

The Retention Table

[after]

Each proposed period was checked with the team that owns the decision. The route optimization team confirmed that model retraining uses only the most recent six weeks, because older traffic patterns degrade the model.

Table 1

Location Fields, the Decisions They Serve and Proposed Retention

The Expectations of the Context

Nissenbaum (2004) argued that privacy is best understood as contextual integrity: an information flow is appropriate when it fits the norms of the context in which the information was shared. Couriers share their location so they can be dispatched and paid. Customers share their address so a parcel arrives. Neither flow carries an expectation that the company will hold a multi-year record of where a particular courier drove every five seconds, or of every address a customer ever used. Retaining the data past its decision does not serve the context in which it was given.

Why Removing Names Does Not Settle It

A common response is that the location tables are keyed by internal identifiers rather than names. Narayanan and Shmatikov (2008) showed how weak that protection can be. Using the movie ratings Netflix released for a public competition, stripped of names, they reidentified subscribers by matching a few ratings and dates against public reviews on another site. Location traces are even more distinctive than movie ratings: a courier's start and end points each day reveal a home address. Acquisti et al. (2015) reviewed evidence that people's privacy concerns depend heavily on context and that they often cannot judge the consequences of data collection, which places the burden of restraint on the organization holding the data.

Cost of the Change

Deleting older precise traces removes the ability to answer questions no one has yet asked, such as a future study of driving behavior over years. The committee should weigh that option value honestly. On the evidence, the cost is small: no current decision uses traces older than six weeks, and the neighborhood summaries preserve trends for planning. Implementation will take about three weeks of engineering time.

Ownership and Review

The data platform lead would own the retention schedule and report quarterly on deletions completed. The committee should review the schedule each January, and any team wanting longer retention would have to name the decision and its frequency.

References

Acquisti, A., Brandimarte, L., & Loewenstein, G. (2015). Privacy and human behavior in the age of information. Science, 347(6221), 509-514. https://doi.org/10.1126/science.aaa1465

Narayanan, A., & Shmatikov, V. (2008). Robust de-anonymization of large sparse datasets. In 2008 IEEE Symposium on Security and Privacy (pp. 111-125). IEEE. https://doi.org/10.1109/SP.2008.33

Nissenbaum, H. (2004). Privacy as contextual integrity. Washington Law Review, 79(1), 119-158.