08.04 Principle of Proportionality

08 Data Protection

In particular, according to the principle of proportionality, only such data may be collected as are necessary and appropriate for the corresponding communicated purpose. For example, when ordering an e-book online, a provider only needs the name (identification), possibly the date of birth (identification, contractual capacity), an e-mail address (communication) and credit card data (payment). The specification of e.g. marital status and profession are neither necessary nor appropriate for processing this business. In a current Swiss case, the Federal Data Protection and Information Commissioner is clarifying whether the sporting goods retailer Decathlon is allowed to require its customers to provide an e-mail address for a purely offline purchase in a shop (see Blick 07.05.2018). The prerequisite would be that an e-mail address is required for a purely offline purchase. This is probably not the case and thus a violation of the principle of proportionality. The principle of proportionality also means that data may only be stored as long as necessary for the purpose. Since there is usually sufficient storage capacity available and thus no technical necessity for deletion, failure to carry out the actual deletion required may be one of the most frequent violations of data protection law.

08 Data Protection