Question

A privacy engineer is reviewing a new marketing web form before launch. The business wants to capture as much prospect information as possible for future campaigns, so the form currently includes 22 fields, including date of birth, household income, and national ID number. The stated purpose is to send prospects an email newsletter and occasional product offers. Which action best aligns the form design with the data minimization and collection limitation principles?

Accepted Answer

Reduce the form to only the fields required to deliver the newsletter and offers (such as email and name), and remove or make truly optional any field not needed for that stated purpose

Answer

Keep all 22 fields but add a consent checkbox stating that data may be used for future undefined marketing purposes

Answer

Keep all 22 fields but encrypt the national ID and household income values at rest to protect the sensitive data

Answer

Keep all 22 fields and add a retention schedule that deletes the excess data after 24 months