A marketing team wants to launch a new customer loyalty app. During the design review, the privacy officer notes that the app's registration form requests the customer's date of birth, home address, income bracket, and social media handles, even though the loyalty program only requires an email address and purchase history to function. Which data privacy principle should the privacy officer cite to challenge the current design?