Privacy Decisions: Ask What Data the Task Really Needs

Start with a purpose, not a long form

A form can request information that is easy to collect but unnecessary for its job. Before adding a field, finish the sentence: “We need this information so that we can…” Then ask whether a less identifying field, an aggregate total or no collection at all would produce the required result.

The three initial paper-only audits use fictional aggregate figures and abstract field labels; the extension adds related accessibility and permission decisions. Do not complete them with real learner or adult information. They illustrate privacy-conscious design choices; they do not certify compliance with any law or prove that a real service is secure.

Data minimisation means limiting collection to what the stated purpose genuinely needs. It does not mean deleting every useful distinction. Removing the equipment category from a count might prevent the intended comparison, while removing the counter’s name need not affect it at all. The reason for each decision matters more than how short the final form looks.

Worked case 1: count equipment without identifying people

A fictional display store wants to know how many stands and trays are ready. Its task is a snapshot of objects, not finding who borrowed something or assessing a worker. The supplied aggregate result is stands: 12; trays: 9.

The reduced record can contain just category and quantity. Twelve plus nine gives 21 available objects, but keeping the two category totals is useful: a tray cannot automatically replace a stand. Removing identity does not stop the store answering either the category question or the overall-total question.

Suppose someone adds a stable code to “avoid names”. That may still let entries be connected across dates or matched with a separate lookup list. Changing the label does not remove the linking function. This particular snapshot needs neither a name nor a persistent person code.

There is also a limit to the reduced record. It cannot tell the store which person has an unreturned item. That is acceptable because individual borrowing is outside the stated purpose. If that task becomes necessary, define it separately and reconsider the information and safeguards required; do not quietly treat the count sheet as a borrower register.

Worked case 2: a voluntary adult event-interest poll

A fictional organiser wants to choose between a paper-folding demonstration and a display-layout demonstration. The poll is voluntary and reports totals only. Supplied aggregate choices are paper folding: 14 and display layout: 10. No response records or personal profiles are provided.

Paper folding has four more recorded choices. That supports a comparison of responses, not a claim that all adults in the community prefer it. Voluntary participation and possible repeat responses limit the interpretation. Adding a persistent identifier to detect repeats would introduce a new collection trade-off; do not pretend that a minimal anonymous tally proves one response per person.

Now the organiser proposes using the poll to send promotional messages. That changes the purpose from choosing a topic to contacting individuals. The original anonymous totals cannot perform that job. Do not infer permission to collect contacts or send messages from participation in the poll. Reconsider the new purpose, audience expectations and appropriate choices before any separate collection occurs.

A less identifying option is to announce the selected topic on a public notice without building a contact list. If individual invitations truly become an agreed service, some contact destination would be functionally necessary. That necessity must be justified for the new service; it does not retroactively justify adding it to the original poll.

Worked case 3: a room-capacity tally

A paper planning model compares supplied limits with aggregate counts: Room A has a limit of 40 and a count of 31; Room B has a limit of 30 and a count of 27. These are fictional planning figures, not certified occupancy limits or an operational safety system.

Room A has 40 − 31 = 9 remaining places in the model. Room B has 30 − 27 = 3. The comparison needs room labels, supplied limits and current totals. A list of names, device identifiers or exact arrivals does not improve this arithmetic.

A running count would need to reflect arrivals and departures, but it need not automatically preserve a person-by-person movement history. Keep the result at the level required by the task. Combining many small, precisely timed totals with observations from elsewhere could still reveal information about individuals, so the word “aggregate” is not a guarantee of anonymity.

Separate access from appropriate use

An authorised operator may be able to open a dataset without being justified in using it for every possible purpose. Access answers “Can this account read it?” Purpose review asks “Does this use fit the task people expected?” They are related questions, but answering one does not settle the other.

Before retaining or sharing a tally, ask what detail the recipient needs and how long it remains useful. For these one-off exercises, the final totals answer the questions; there is no need to invent indefinitely retained individual histories. Minimisation reduces the amount available for misuse, but security, context and onward use still matter.

Record a clear limitation with the conclusion. An anonymous interest tally cannot support personalised reminders; an object total cannot identify a borrower; an aggregate room count cannot explain everyone’s movements. Honest limitations prevent a later reader from assuming that missing data can somehow be reconstructed.

Three solved practice tasks

Task 1: does removing a name settle privacy?

A tally removes PERSON_NAME but keeps the same PERSON_CODE each day. Explain the remaining issue. Solution: the code can link one person’s entries over time or join them to another record. For a one-off aggregate tally, remove that code unless a distinct necessity is established.

Task 2: distinguish necessary from merely available

A form counts ready chairs by room. Should it retain room label and HOME_ADDRESS? Solution: retain the room label because the requested comparison is by room. Remove HOME_ADDRESS because it does not help count chairs in those rooms.

Task 3: identify the changed use

An operator can read anonymous event totals and wants to build named attendance profiles. Is existing access enough? Solution: no. Named profiles are a new purpose and cannot be obtained from the totals alone. Reconsider that proposal rather than treating access as permission for extra collection or linking.

Further reading

Technical background: W3C Technical Architecture Group — privacy design principles. Examples, questions and diagrams in this lesson are original.