Field Notes

concept

Data minimization

StatusStableUpdatedStands on3 sourcesSupportsnotes

Data minimization means collecting, retaining, and exposing only the information necessary for a defined purpose. It is a security control, a privacy principle, and a limit on institutional power.

Every retained field creates a future attack surface. It can be breached, misconfigured, sold, inferred from, compelled, copied into a case file, or combined with another dataset. The question is therefore not merely whether a company can secure a field. It is whether the field should exist at all.

Why it matters

Minimization reduces the blast radius of failure. It limits what an attacker, abusive partner, overbroad investigator, careless employee, or future acquirer can learn. It also protects people who never chose to become part of a record, such as a patient’s family, a journalist’s source, or a person’s genetic relatives.

Some data cannot be made harmless after disclosure. Therapy notes, location history, biometrics, intimate images, immigration records, and family graphs may create lasting exposure. These are High-consequence data.

The future acquirer is the case minimization handles worst, because nothing has to go wrong for the exposure to arrive. A field collected lawfully for a stated purpose can reach an entity the user never evaluated through an ordinary corporate split or sale, and where it has been absorbed into a trained model the transfer may not be reversible at all. Niantic Spatial is the vault’s worked instance, and What happens to data consent when a company is split or sold records what remains unresolved. A field that was never collected survives this intact, which is the strongest argument minimization has.

Design questions

For every field, system, and integration, ask:

  • What specific user value or legal duty requires this?
  • Can the purpose work with a less precise value?
  • Can it be kept on the user’s device or in a separate system?
  • Who needs access, for how long, and under what review?
  • Can the service function after the field is deleted or anonymized?
  • What would this field reveal if combined with other records?

The resulting architecture may separate billing from service access, content from support history, or identity from telemetry. Those boundaries are Privacy product architecture.

Operational implications

Minimization requires more than a privacy notice. It needs a data inventory, retention schedule, access control, deletion testing, vendor discipline, and exception review. Those controls are Privacy trust and governance.

Minimization does not promise immunity from lawful process. It means that a legitimate request, breach, or system failure has less material to expose. That is harm prevention, not obstruction. Ethics of resisting lawful extraction applies the same principle to coercive access and third-party confidences.

Built on 3 sources (2 archived here, 1 external).

Working out connections…