Data Protection by design & by default
When should this principle be applied?
The principle should be applied already when processing is being designed, therefore, before collecting personal data. It is not an analysis to carry out only at the time of the design of data processing, but it should be repeated during the time of processing in order to ensure that the decisions taken are still valid. As a matter of fact, there might be different conditions (e.g.: further envisaged purposes of processing) or new laws and regulations which govern data protection and imply a new analysis of the processing activities which are being carried out.
What does data minimisation mean?
The controller should select what data are necessary to pursue the purposes for which such data are collected. In order to determine what data to collect, the controller must make sure to process only data without which the data subject’s request cannot be fulfilled. Additional data may be collected only if there are valid reasons for specific and determined further purposes; the controller must ensure that the data subject can provide such additional data on an optional basis. Processing of such additional data needs to have a ground on one or more legal bases (in compliance with the principle of lawfulness of processing): this legal basis is usually different from the legal basis (or the legal bases) for processing those data which are requested as mandatory.
To learn more, click here or contact me.
Leave a Reply