T 2.165 Lack of or inadequate data avoidance and data economy regarding the processing of personal data

Data avoidance and data economy are basic requirements to be taken into consideration when determining the data to be collected, processed, or used in accordance with type, scope, and duration. At the same time, they are specifications for the technical design and data selection. Amongst other things, this basic principle may be violated by the following:

• collection of more data than required for the processing purpose (e.g. more than two communication processes such as mail address, phone number, and email address for contractual purposes),
• processing of data with a higher degree of detail than required (e.g. processing of birth date and credit card number when only a confirmation of an age of more than 18 years is required),
• processing and storing personal data over a longer period of time than required for the purpose (e.g. security analysis of log files of a firewall).

Whenever possible, the anonymisation and pseudonymisation options must be used.