The principle of data minimisation is part of the principles according with which data processing is carried out. It means that a controller shall only process the data that he needs in order to reach the purposes of the processing.
The principle of data minimisation consists of three main elements:
- Adequacy of data, that is, proportionality with respect to the purposes for which they were collected
- Relevance of data with regard to the previously specified purposes
- Restriction of processing to the specific purposes outlined
Thus, the collected data must be adequate and relevant to the purpose it intends to achieve, and it cannot be collected to a greater extent than necessary. In essence, the Regulation states that there is an obligation to ensure that only strictly necessary personal data are collected for processing.
In this regard, the principle of data accuracy is to be introduced as well. In fact, the Regulation specifies that the processed data must be accurate, and if necessary, updated. The controller must take all measures necessary to promptly cancel or correct the information that is no longer accurate.
Article 16 of the Regulation, states the following on the right of rectification: "The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement".
Finally, it should be borne in mind that only the data necessary to reach the purposes that were initially defined, may be processed. Moreover, the data must be accurate, that is, correct in all details. If the data subject requests the update of his/her data, the controller shall rectify it without undue delay.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.