About Data Minimization

Overview

• What Is Data Minimization?

• Data Minimization Basic Principles

• Data Minimization Benefits to Consumers

• Data Minimization for Your Business' Digital Health

The International Association of Privacy Professionals (IAPP) defines data minimization as a practice for organizations to "only collect and retain that personal data which is necessary." Data minimization is a fundamental principle of Privacy by Design. The less data your organization holds, the fewer chances there are of compromising users' privacy.

Data minimization isn't simply collecting less data, though. It also sets limits on what your organization is allowed to do with user data. For example, businesses must gather data for a specific purpose, store it securely, and delete it once the purpose has been fulfilled. This minimization principle helps organizations be more methodical and intentional about users' privacy protections.

As data minimization is a privacy concept that’s written into the European Union's General Data Protection Regulation (GDPR), it's one of the best practices for privacy-conscious businesses worldwide. Here's how your business can start thinking about and implementing data minimization into your privacy program.

While data minimization may seem straightforward, in practice, it requires businesses to rethink how they collect, process, store, retain, and delete user data. Before user privacy became a major concern, businesses weren't as careful about the types of data they gathered, where they stored it, or how long they kept it. Now, organizations must manage user data in a way that mitigates potential harms to consumers, as well as the business itself.

In sum, one of the best ways to combat privacy issues is implementing data minimization practices. Data can't be misused if your organization doesn't have it in the first place. However, in order to know what data you don’t need, you first have to understand what data you have. The steps below will help your team get serious about data minimization.

Here are four effective steps to start practicing data minimization, according to The Little Blue Book of Privacy Design Strategies:

1. Select only necessary and relevant data.
2. Exclude unnecessary and irrelevant data.
3. Strip unnecessary and irrelevant data that already exists in systems.
4. Destroy data that has fulfilled its specific purpose.

Data Minimization Principle #1: Select

Data minimization doesn't mean your business can't collect any data. Rather, your company must collect data for legitimate business purposes. In Europe, data can only be collected if there is a legal basis for processing it under GDPR. Under GDPR, there are a total of six legal bases for data processing:

• Consent.
• Performance of a contract.
• Legitimate interest.
• Vital interest.
• Legal requirement.
• Public interest.

Additionally, your business should not use that data for other purposes users have not consented to, such as targeted advertising. Users should have a reasonable expectation of what your organization is doing with their data. Selecting only the most necessary data will help your business make sure it won't amass more data than it can handle, and use it for undisclosed purposes.

Data Minimization Principle #2: Exclude

Placing limits on the data your business collects will also protect your organization from collecting more data than it can manage. As Big Tech companies are realizing, accumulating vast oceans of data is very difficult to manage in a way that respects user privacy. That's why it's important for companies to gather the least amount of data necessary to fulfill a specific goal.

For example, if your business ships products to customers, you may need to collect their address. You would not, however, need to collect their social security number. This example may seem simplistic, but it illustrates the importance of deciding what kinds of data is relevant for your business, what isn't, and why.

Collecting only the necessary amounts of data will protect your business and consumers from privacy violations.

Data Minimization Principle #3: Strip

After selecting the types of data to collect and excluding unnecessary data from collection, there may still be elements within the data that do not need to be passed downstream deeper into the data structure.

For example, credit card processors often only use the ZIP code of an address to verify card ownership. In a case like this, privacy engineers can work to strip down the address data passed to the backend so that it only contains the ZIP, and no other information that would help identify the user.

In Europe, there have been GDPR fines specifically for “non-adherence to the principles of data minimization.” While there aren’t yet similar penalties under California's CCPA or other U.S. privacy laws, data minimization remains an excellent business practice to ensure that a business’s data operation is lean, efficient, and low-risk.

Data Minimization Principle #4: Destroy

Data deletion, or data erasure, is an essential component of data minimization. According to the GDPR, organizations "should collect only the personal data they really need, and should keep it only for as long as they need it." That means companies must be methodical about their retention periods for consumer data.

Once the business purpose has been fulfilled, the data has reached the end of its lifecycle and should be properly deleted. Although effective data erasure is often more complicated than simply deleting values in cells, if your business has no further use for the data, it should not be retained. This applies to backup copies as well - even they should be scrubbed at the end of a designated retention period.

Practicing these data minimization principles will help your business maintain compliance with the various regulations worldwide. However, implementing these principles can be cumbersome for engineers to do manually. That's why Ethyca built the Fides privacy engineering platform. With Fides, you'll be able to program exactly what data you're allowed to collect, what to exclude, and when and what to delete. With privacy rules based on the Fides taxonomy and enforceable as part of normal engineering workflows, Fides lets dev teams code the business' privacy policy as a guardrail in data infrastructure. In short, Fides will make data minimization easier for your business to practice.

Adhering to the principle of data minimization forces businesses to get serious about the kinds of data they're collecting and why. This will not only keep your data systems organized and compliant, it will also help your business build trust with consumers. Thanks to new privacy laws, users have more rights and control over their data. Specifically under Article 30 of GDPR, organizations must be able to generate a Record of Processing Activities (RoPA) of user data.

Under these regulations, businesses are now legally obligated to fulfill user subject requests, or DSRs. If your organization has a clear understanding of what user data is collected, where it flows within systems, and when it's properly destroyed, it will be easier to prove to consumers that your data practices respect their privacy rights.

In conclusion, data minimization is a core privacy protection principle that will help you ensure purposeful and compliant data collection, storage, and deletion processes. Enshrining this practice at the core of your data operations will not only help you protect users' privacy, it will also mitigate potential harms and costly fines for your business.