How it works
Collecting data creates obligations. The relevant questions are what is collected, why it is necessary, who can see it, and how long it is kept.
Apply data minimisation: collect only what the stated purpose requires.
Common error
Treating anonymisation as absolute. Combining datasets can re-identify individuals.
Worked example
Example
Goal: count library visits by weekday
Proposed fields: name, exact location history, timestamp
Public output needed: weekday totalsCollecting detailed individual histories is not necessary merely to publish weekday counts. Minimize retained data, restrict access, and choose an appropriate retention period. Removing names alone may not prevent re-identification through other fields.
Exercises
9.2.1 · Explain
What information is sufficient for publishing total visits by weekday?
Show solution
Aggregate weekday counts can satisfy the output requirement without publishing identifiable individual visit histories.
9.2.2 · Explain
Why should a retention rule be part of design rather than a cleanup task postponed indefinitely?
Show solution
The amount of stored data affects exposure and maintenance over time. A defined deletion process limits unnecessary accumulation and makes responsibility explicit.