Data Minimization is a privacy concept that’s written into GDPR and is a best-practice for privacy-conscious businesses worldwide. It holds that businesses should collect and process only the bare minimum amount of data needed to accomplish a goal.
Data Minimization is a privacy concept that’s written into GDPR and is a best-practice for privacy-conscious businesses worldwide.
It holds that businesses should collect and process only the bare minimum amount of data needed to accomplish a goal.
That means you should:
Seems straightforward, right? In practice, data minimization is a pretty radical change for a lot of businesses. It forces them to take a “ready, aim, fire” approach to the data they use instead of the scatter gun approach that was common before digital privacy became a concern.
In particular, adhering to a principle of data minimization forces businesses to get serious about Data Entitlements within their organization. Sharing data internally becomes a closely controlled process. Questions like, “Could you put that list of email addresses on this flash drive?” or “Could I get your login for the CRM?” can no longer be answered with a yes — in fact, they can no longer be asked.
In Europe, there have been GDPR fines specifically for “non-adherence to the principles of data minimization.” While there aren’t similar penalties under the CCPA or other US privacy laws, it remains an excellent business practice to ensure that a business’s data operation is lean, efficient, and low-risk.
Recently, Ethyca CEO was in conversation with the Regional Head of BCG Venture, Paul Hunyor, at the World Economic forum in Davos Switzerland. Their conversation touched on challenges posed by Data Minimization and other privacy best practices. You can listen below:
At Ethyca, we believe that software engineers are becoming major privacy stakeholders, but do they feel the same way? To answer this question, we went out and asked 337 software engineers what they think about the state of contemporary privacy… and how they would improve it.
The UK’s new Data Reform Bill is set to ease data privacy compliance burdens on businesses to enable convenience and spark innovation in the country. We explain why convenience should not be the end result of a country’s privacy legislation.
Our team at Ethyca attended the PEPR 2022 Conference in Santa Monica live and virtually between June 23rd and 24th. We compiled three main takeaways after listening to so many great presentations about the current state of privacy engineering, and how the field will change in the future.
For privacy engineers to build privacy directly into the codebase, they need agreed-upon definitions for translating policy into code. Ethyca CEO Cillian unveils an open source system to standardize definitions for personal data living in the tech stack.
Masking data is an essential part of modern privacy engineering. We highlight a handful of masking strategies made possible with the Fides open-source platform, and we explain the difference between key terms: pseudonymization and anonymization.
The American Data Privacy and Protection Act is gaining attention as one of the most promising federal privacy bills in recent history. We highlight some of the key provisions with an emphasis on their relationship to privacy engineering.
Our team of data privacy devotees would love to show you how Ethyca helps engineers deploy CCPA, GDPR, and LGPD privacy compliance deep into business systems. Let’s chat!
Book a Demo