CIPT: Certified Information Privacy Technologist

Data minimization requires an organization to collect, use, and retain only the personal information necessary for a specific business purpose. It reduces privacy risk by avoiding unnecessary customer data collection and storage. The Federal Trade Commission describes sound data-minimization practices as limiting collection and retaining personal data only for an essential period.

The Code of Fair Information Practice Principles (FIPPs) was developed in the 1973 HEW report Records, Computers, and the Rights of Citizens. It predates later privacy frameworks, including the OECD Privacy Guidelines, adopted in 1980.

Deletion, de-identification, and aggregation are recognized ways to dispose of data or reduce its identifiability after retention ends. Retagging merely changes metadata and does not provide an appropriate end-of-retention disposition.

IoT devices can collect detailed personal behavioral data. Using driving habits gathered from a connected car to change an individual’s insurance rates is a privacy risk because personal data is used to make a consequential decision about that person.

Data-quality assurance should validate accuracy, collection processes, and data-change history without compromising the dataset. Deliberately introducing erroneous data contaminates the data rather than providing an appropriate assurance control.