Data minimisation

Data minimisation is a data protection principle that requires personal data to be processed only to the extent necessary for a specified purpose. The term data economy describes the same underlying concept, while the General Data Protection Regulation (GDPR) expressly refers to data minimisation. The legal basis is Article 5(1)(c) GDPR.

What does data minimisation mean, and how does it differ from data economy?

The principle of data minimisation requires companies and other controllers to limit the processing of personal data to what is necessary. Under Article 5(1)(c) GDPR, personal data must be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.

Data economy is a term originating in earlier German data protection law. It describes the aim of collecting, processing and using as little personal data as possible. Instead, the GDPR uses the term data minimisation and places the emphasis on whether the processing of data is necessary for the relevant purpose.

In everyday usage, the two terms are often treated as synonymous. However, the legally relevant principle is data minimisation under Article 5(1)(c) GDPR.

Data minimisation does not mean that companies are generally prohibited from collecting personal data. The decisive question is whether the information in question is needed for a lawful and clearly defined processing purpose.

What requirements does the GDPR impose on data minimisation?

Data minimisation is one of the fundamental principles relating to processing set out in Article 5 GDPR. For every processing activity, controllers must assess which personal data are necessary to achieve the intended purpose.

Three requirements are particularly important:

• Adequacy: The type and scope of the data processed must be appropriate in relation to the processing purpose.
• Relevance: The information processed must be relevant to the purpose in question.
• Limitation to what is necessary: Personal data must not be processed beyond the extent required for the intended purpose.

These requirements apply not only when personal data are initially collected. The subsequent use, disclosure and other processing of personal data must also comply with the principle of data minimisation.

Consent does not override this principle. Even where processing is based on valid consent, the general data protection principles must still be observed.

Under Article 5(2) GDPR, controllers must be able to demonstrate compliance with the principles relating to processing. Companies should therefore document clearly which data are required for each processing activity.

How can companies implement data minimisation in practice?

Data minimisation starts at the planning stage of a processing activity. Companies must first define the processing purpose and then assess which personal information is necessary for that purpose.

Appropriate measures include, in particular:

• Limiting mandatory fields: Forms and registration processes should only require data that are necessary for the relevant purpose.
• Avoiding unnecessary data collection: Information that has no sufficient connection to the processing purpose should not be collected.
• Anonymisation: Where the processing purpose can be achieved without identifying individuals, anonymous data should be used.
• Pseudonymisation: Identifying characteristics should be replaced with identifiers where this is appropriate for the processing activity in question.
• Restricting data access: Employees should only be granted access to personal data that they need to perform their duties.
• Reviewing existing processes: Companies should regularly check whether the data being processed remain necessary for the specified purposes.

Data minimisation is particularly important when developing digital applications. Under Article 25 GDPR, controllers must take data protection into account both by design and by default.

In particular, default settings must ensure that, as a general rule, only personal data necessary for the relevant processing purpose are processed. This applies, among other things, to the amount of data collected, the extent of processing, the storage period and accessibility.

What is the difference between data minimisation and storage limitation?

Data minimisation and storage limitation are two distinct data protection principles that complement each other.

Data minimisation under Article 5(1)(c) GDPR primarily concerns which personal data and what extent of processing are necessary for a particular purpose.

Storage limitation under Article 5(1)(e) GDPR, by contrast, governs how long personal data may be stored in a form that permits the identification of data subjects.

For example, a company may collect only the customer data it needs and thereby comply with the principle of data minimisation. However, if it retains those data for longer than permitted, it may breach the principle of storage limitation.

Statutory retention obligations must also be taken into account. They may require personal data to be retained even after the original processing purpose has been fulfilled.

Both principles must therefore be taken into consideration when designing and carrying out processing activities.

What are the consequences of breaching the principle of data minimisation?

The processing of unnecessary personal data may constitute a breach of Article 5(1)(c) GDPR. This may occur, for example, where companies collect or further process additional personal information without a sufficient connection to the relevant purpose.

Under Article 58 GDPR, the competent supervisory authority may order measures to remedy the infringement. These may include restricting unlawful processing activities or ordering the erasure of unlawfully processed data.

Infringements of the fundamental principles relating to processing may also be subject to administrative fines under Article 83(5)(a) GDPR. The statutory maximum is up to EUR 20 million or, in the case of an undertaking, up to 4% of its total worldwide annual turnover in the preceding financial year, whichever is higher.

Consistent application of data minimisation also reduces security risks. Processing less personal data generally reduces the volume of information that may be affected in the event of a personal data breach.

Practical example: Data minimisation during customer registration

An online shop allows customers to create a user account. Initially, the company requires customers to provide their full name, home address, date of birth, telephone number and email address to register.

Upon review, the online shop determines that only an email address and appropriate login credentials are required to create and use the account. The delivery address is only collected when an order is placed, while providing a telephone number remains voluntary in principle.

The company then adapts its registration process and removes the mandatory fields that are not necessary. As a result, personal data are only collected when they are required for a specific processing activity.

For the subsequent fulfilment of orders, the online shop processes the necessary delivery and payment information. Statutory retention obligations are complied with separately.

legal data assessment: Data minimisation must be taken into account from the outset when designing business processes. For each processing activity, companies should determine which personal data are actually required and consistently avoid unnecessary mandatory fields. A data-minimising approach reduces legal risks, simplifies data management and supports compliance with the GDPR.

Legal bases

Article 5(1)(b), (c) and (e) and Article 5(2) GDPR; Article 6 GDPR; Articles 24 and 25 GDPR; Articles 58 and 83 GDPR.