Question

A product team is launching a new mobile fitness app. During design, they propose collecting the user's precise GPS location, full contact list, and device advertising ID, even though the core feature only requires the user's step count and general activity level. The privacy officer reviews the design before development begins. Which principle should the privacy officer invoke to challenge the proposed data collection?

Accepted Answer

Data minimization — collect only the personal data necessary for the stated purpose

Answer

Data remanence — ensure residual data is unrecoverable after deletion

Answer

Separation of duties — split collection responsibilities among multiple staff

Answer

Defensible destruction — dispose of data per a documented retention schedule