Week 07 · lesson

Collect Less, Protect More

The safest sensitive field is often the field you never collected.

Data minimization means collecting only the information needed for a defined purpose, keeping access as narrow as practical, and not retaining information forever “just in case.”

Start with purpose before field

Fictional event-registration goal:

Estimate attendance and session interest for a school technology showcase.

Possible fields:

Proposed field	Needed for stated purpose?	Decision
session choice	yes	collect
attendance yes/no	yes	collect
full home address	no	remove
medical history	no	remove
personal phone number	probably no	remove
open comment	maybe	justify or omit

A field can be easy to collect and still be unjustified.

Trace who can reach the responses

Forms can feed a response sheet. That means access decisions may exist in more than one place:

RESPONDENT
    ↓
   FORM
    ↓
RESPONSES
    ↓
  SHEET
    ↓
VIEWER / EDITOR ACCESS

Protecting the Form link while broadly sharing the response Sheet can defeat the privacy design.

Retention is part of the lifecycle

Ask three questions:

Why are we collecting this field?
Who needs access while the project is active?
When does the information stop being needed?

This course does not require you to implement a real institutional retention policy. It does require you to notice that “keep it forever” is a decision, not a neutral default.

Worked minimization decision

A classroom feedback form wants to learn which lesson was hardest. The designer adds Student name because “it might help later.”

If the purpose is aggregate course feedback, identity may not be needed. Collecting names can change how honestly people respond and increases the sensitivity of the dataset.

Remove the field unless the purpose actually requires follow-up tied to identity.

Build a Data Minimization and Access Map

Use your prototype from Lesson 2. For every field, record:

stated purpose;
required/optional;
sensitivity level in this classroom context;
keep/remove decision;
who needs response access;
when the data can be deleted or retired in the fictional scenario.

Then draw the Form → Responses → Sheet access chain.

Failure mode: privacy notice with unnecessary collection

A nice paragraph that says “we care about privacy” does not justify collecting extra data. The fields and access settings are the stronger evidence.

Evidence

Submit the Data Minimization and Access Map. It must include at least one field you removed or deliberately chose not to collect.

The goal is not zero data. The goal is enough data for the job, no more than the job needs.