The $12.75 Million Case for Data Minimization

As organizations navigate an increasingly complex global privacy landscape, one particular principle has remained constant and critical: data minimization.

Data minimization: from privacy principle to legal requirement

Data minimization is associated with the EU General Data Protection Regulation (GDPR), but its origin and relevance extend well beyond Europe. Now it is a central expectation across U.S. and global privacy frameworks, underscoring a fundamental shift in how organizations think about collecting and using personal data.

Early international privacy frameworks such as the OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data (1980) set expectations around data collection limitation, emphasizing that personal data collection should be limited to what is necessary and obtained fairly. GDPR did not create data minimization, it elevated and operationalized a long-standing privacy expectation.

U.S. privacy laws have historically taken a sectoral approach, for example HIPPA in respect of healthcare. Today, data minimization is explicitly embedded in 19 U.S. state privacy Acts such as the California Consumer Privacy Act (CCPA), Virginia Consumer Data Protection Act (VCDPA) and Colorado Privacy Act (CPA), to name only a few. Broadly, organizations must limit the collection, use, retention, and sharing of personal data to what is reasonably necessary and proportionate to achieve the purpose for which the data was collected.

Enforcement is raising the stakes

Recent enforcement activity highlights how data minimization and related concepts are being applied in practice.

Recently, California regulators reached a $12.75 million settlement with General Motors and OnStar over allegations of unlawful collection and sale of Californians' driving and location data. The settlement represents the largest California privacy regulator fine issued to date.

Reportedly, the automaker sold drivers' geolocation data, driving behavior data and other personally identifiable information to data brokers without obtaining consumer consent.

The lesson is clear: compliance is no longer just about enabling rights. It is about designing processes that regulate data collection and avoid the improper use of personal data.

The business benefits of collecting less data

This is not just about mitigating fines. There are considerable upsides to data minimization - the fewer data elements an organization stores, the smaller its attack surface and the lower the potential impact of a data breach. From a governance standpoint, data minimization simplifies compliance. Organizations that limit data collection are better positioned to efficiently respond to access, deletion, and correction requests. From a customer perspective, data minimization builds trust. When individuals understand that an organization only collects what it genuinely needs, they are more likely to engage confidently.

Organizations historically approached data collection from a position of opportunity. If data might be useful in the future, it was often collected “just in case.” The Ford case reinforces a necessary shift in that perspective. It is no longer sufficient to ask whether data collection or processing is technically permissible. Organizations must also consider whether it is proportionate and necessary.

At Extreme Networks, we take a principled approach to data collection and use, grounded in transparency, necessity, and accountability. To learn more about our practices—including our Privacy Notice and approach to safeguarding personal data—visit the Extreme Networks Privacy Center.