Data Minimization's Substantive Turn: Key Questions and Operational Challenges Posed by New State Privacy Legislation

Abstract

Data minimization is a bedrock principle of privacy and data protection law, with origins in the Fair Information Practice Principles (FIPPs) and the Privacy Act of 1974. At a high level, data minimization prohibits a covered entity from collecting, using, or retaining more personal data than is necessary to accomplish an identified, lawful purpose. In recent years, data minimization has emerged as a contested and priority issue in privacy legislation. Under longstanding notice-and-choice legal regimes, companies have been subject to “procedural” data minimization requirements whereby collection and use of personal data is permitted so long as it is adequately disclosed or consent is obtained. As privacy advocates have pushed to shift away from notice-and-choice, some policymakers have begun to embrace new “substantive” data minimization rules that aim to place default restrictions on the purposes for which personal data can be collected, used, or shared, typically requiring some connection between the personal data and the provision or maintenance of a requested product or service. For its proponents, this substantive turn promises to better align companies’ collection and use of personal data with consumers’ reasonable expectations. For its detractors, however, this trend threatens to upend longstanding business practices, introduce legal uncertainty, and threaten socially beneficial uses of data. The core of this debate is really the societal value of different uses of data, and whether certain data uses should be allowed, encouraged, discouraged, or prohibited by default, which itself is a proxy for major economic and political decisions with vast societal implications. 

This white paper explores state lawmakers’ turn towards substantive data minimization. In Part I, this paper identifies the relevant standards: procedural data minimization (the majority rule); substantive data minimization (the rule that is currently law in Maryland and several sectoral laws); and reasonable expectations (the approach taken by California). These substantive data minimization rules raise a number of challenges and unresolved questions, which are explored in Part II. The questions raised by substantive data minimization include: (1) The role of consent; (2) How to determine what is “necessary” to provide a requested product or service; (3) The role of default protections versus individual control; (4) Whether substantive data minimization is too uncertain; (5) Whether procedural and substantive data minimization can be characterized as “objective” and “subjective”; and (6) The interplay between substantive data minimization and a law’s exceptions. How these questions are resolved will have significant implications for economic activity and data-intensive business practices, including advertising, artificial intelligence, and product improvement generally. The paper concludes by briefly outlining several options for how policymakers could approach constructing a forward-looking, flexible substantive data minimization rule.

This paper was written in the author's capacity as a Policy Counsel at the Future of Privacy Forum.

Keywords: privacy, privacy legislation, state privacy, state privacy law, data minimization, data minimisation, purpose limitation, secondary use, comprehensive privacy, state comprehensive privacy law