When collecting personal information, the GDPR principles state that organizations must act transparently and with consent, collecting data only for the explicit purpose it’s needed. They also put strong legal protection on sensitive, identifying information, often referred to as PII or Personal Identifying Information.

When GDPR was introduced, organizations were quick to meet this legislation’s requirements, with the threat of serious financial repercussions if they failed to do so. But there’s still more they can do to serve consumers ethically and responsibly during data collection.

Before you begin collecting data, have you considered..?

1) Getting consent to collect information

Seeking consent is the most appropriate way to legally collect information, while giving customers genuine control over their data.

While consent isn’t always required (such as in cases of legitimate interest and/or legal obligation), the GDPR suggests that consent be given to collect data for an explicit and stated purpose. Even without consent there still needs to be clear and comprehensive information provided about how personal information is used.

Unfortunately, some companies also resort to manipulative user agreements to get the consent they need, but it is not always consent a participant is happy to give. The value of consent is diminished when it becomes a condition of service.

Ask yourself:

• Do you have permission from users or participants to collect their data?
• Have they been made aware that their involvement is voluntary?
• Is it clear that participants are free to withdraw from any active data collection programmed at any point without pressure or fear of retaliation?

2) Protecting users’ confidentiality and anonymity when collecting data

Customers will often opt in to data collection under the assumption that the information collected remains confidential and any published findings are anonymized. If you do need to break confidentiality at any point (or suspect that you will do in future) then make it clear at the start of the process.

Where possible, avoid collecting personally identifiable information (PII). Good practice might be to design your data collection methods in a way that they can’t be reverse engineered to reveal subjects. However, it is also possible to identify people from merging separate datasets with just a few personal pieces of information about them.

Ask yourself: 

• Do you really need to collect PII at all?
• If yes, have you taken steps to de-identify a dataset by removing all PII data before analyzing or sharing the insights?
• Have you considered how different data points could be used in conjunction to reverse engineer identity or identifying characteristics?

3) What do you intend to do with the data you’re collecting?

While it can be hard to know the purpose or value of data in advance — the GDPR supports the practice of purpose limitation. This means organizations shouldn’t operate with an intention of gathering as much as they can, to be used for an undefined purpose, at an undetermined point in the future. Additionally, there will be some information you cannot retain for more than 12 months.

Minimum viable collection is a strategy which relates to the issues of anonymity and intention. This method encourages organizations to only collect the data they absolutely need to ensure a result they want or a trend they aim to understand. This is sometimes referred to as the data minimization principle.

In practice it can be difficult to implement, as it’s not always possible to know every purpose in advance. Being more responsible and trying to avoid this involves thinking critically about each data point you plan to collect.