Data Minimization: A Legally Required Tool to Mitigate Risk

The current landscape of data privacy and security is becoming exponentially more complex, with businesses facing both a growing list of cybersecurity risks and compliance requirements. Data minimization, an evolving requirement in the patchwork of state privacy laws, can also serve to mitigate cybersecurity risk. Now more than ever, businesses need to be aware of the data collected, and the purposes for which data is used.

The classic concept of legislated data minimization is procedural in nature, with laws requiring that data collected must be adequate, relevant and reasonably necessary to achieve a purpose that is disclosed to the data subject. In practice, procedural data minimization is as much about transparency as it is about minimizing the collection and use of the data. In contrast, recent state and federal legislation has moved toward substantive data minimization which limits collection of data to (i) what is reasonably necessary and proportionate to provide a specific product or service requested by the individual, or (ii) to effect a specifically permitted purpose such as data security or compliance with legal obligations.

A rigorous data minimization strategy will automatically guide any business toward more robust data governance protocols. Robust data governance and targeted data retention also significantly reduce the risk associated with the continual growth of cybersecurity and data breach incidents. Implementing a data minimization strategy is a daunting task, but one that can be started by completing the following high-level steps:

1. Audit the data that you are collecting. If you are selling a product, the business may be collecting a consumer’s name, address, email address, phone number and payment information.
2. Document the purpose for the data collected. For each purpose, identify the specific data elements that are being collected. This will generate a data set that is directly tied to each specific business purpose.
3. Document, and directly articulate, why each data element is relevant, necessary and sufficient to achieve the purpose for which the data set was collected.
4. Identify the minimum time needed to retain each data element to fulfill the specified purpose and develop a targeted records retention policy.
5. Update internal and external facing privacy policies. For website privacy policies, ensure that the purpose of data collection is clearly identified and each data element needed to fulfill that stated purpose is clearly articulated.

Data minimization is an essential aspect of data privacy and security. Regardless of the requirements imposed by state law, knowledge of the data your business is collecting, limiting the use of data to its expressly intended purpose and timely destruction of data are key components of an organization’s data privacy and security governance.