Do not collect the data that you do not need.

[em0nm4stodon@infosec.exchange]

Do not collect the data that you do not need.

Do not collect the data
that you do not need.

Do not collect
the data
that you
do not
need
.

#DataMinimization #Privacy #DigitalRights

[minmi@sfba.social]

@Em0nM4stodon

So much this.

Also, once you no longer need the data, do not keep it.

[ghouston@mamot.fr]

@minmi @Em0nM4stodon somebody has to look after it. https://en.wikipedia.org/wiki/Digital_hoarding

[epic_null@infosec.exchange]

@Em0nM4stodon
Step 1: Do not take extra steps to collect data you do not need
Step 2: Remove data you collected that you no longer need
Step 3: Manipulate the data you do need so it only contains what you do need, and not what you don't.

[minmi@sfba.social]

@ghouston @Em0nM4stodon

Oh…oh no

[thunfisch@chaos.social]

@Em0nM4stodon Advertisers everywhere:

Do not need the data that you collect.

[torgo@mastodon.social]

@Em0nM4stodon cf https://www.w3.org/TR/privacy-principles/#data-minimization

[muddle@infosec.exchange]

@Em0nM4stodon also, do not algorithm what is obviously unethical.

[alsvha@sunny.garden]

@Em0nM4stodon But what would I then share with my 1735 _partners_ ?

[svelmoe@hachyderm.io]

@Em0nM4stodon Plus side - less need for all sorts of cookie banners and GDPR notices/procedures.

Both cheaper and easier.

[rotopenguin@mastodon.social]

@Em0nM4stodon counterpoint: do collect the data that you can, or could conceivably at some future point, sell.

[krutonium@social.treehouse.systems]

@Em0nM4stodon Any Data you DO collect should be treated like Toxic Waste.

[muddle@infosec.exchange]

@Em0nM4stodon https://en.wikipedia.org/wiki/Algorithms_%2B_Data_Structures_%3D_Programs

[megalomaniac@mastodon.me.uk]

@Em0nM4stodon “ahhh but we need all the data.”
No you don’t.
“But we might need…”
No you won’t.
“But it’s legitimate interest.”
Is it, is it REALLY?

[mindiell@mamot.fr]

@Em0nM4stodon Do not collect the data

[bradr@infosec.exchange]

@Em0nM4stodon

12 step programs for data addicts

[xs4me2@mastodon.social]

@Em0nM4stodon

Rather in regulations.

Data that is not needed shall not be collected.

[stiiin@infosec.space]

@Epic_Null @Em0nM4stodon The missile knows where it is at all times.

[bastelwombat@chaos.social]

@Em0nM4stodon It makes #GDPR compliance soooo much easier.

[cppguy@infosec.space]

@Epic_Null @Em0nM4stodon

Step 4: ensure that the data is accurate and, where necessary, up to date:

Principle (d): Accuracy

(ico.org.uk)

Step 5: don't process the data in ways that are incompatible with your original reason for collecting it:

Principle (b): Purpose limitation

(ico.org.uk)