Article 5 of the UK GDPR sets out seven key principles which lie at the heart of the general data protection regime. That principle that has become known as "Data Minimisation" is paragraph c) which reads

(personal data shall be) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.

Many companies are either unaware of this requirement or choose to ignore it. Frequently, in order to open an account, you are required to enter your first name, last name, date of birth. address (including postcode) and telephone number. But how many times is this information Needed for the transaction in question. We have purchased tickets on-line for the cinema and been asked to supply this information. What difference can it make to the cinema where we live or what our mobile number is. The request for this information exceeds the company's authority under the GDPR.

Many of us fall into the trap of answering the question because it has been asked. For example, if the form says "fill in the boxes" and one of the boxes says "Date Of Birth" we often just fill it in without thinking. But do we really need to enter that information? If you are going to see an age restricted film, the cinema does not need to know your date of birth, it just needs to know if you are of the relevant age. The form field could equally say "Do you meet the minimum age requirement for this film?". For those people that say we could lie and say "Yes" regardless of our age; we could just as easily lie about our date of birth, that is no more secure or accurate.

So how do we minimise the data we give when filling out the form?

Not all form fields are required. Just complete those fields you are happy to complete. If, as many websites do, they make fields you do not wish to complete compulsory, don't use real information. Some options you have are:

• In name fields put something comical and obviously false. "Harry Potter" is an obvious one but you could use Batman, Superman, Donald Duck or anything else that comes to mind.
• in Mobile number you may need to use a format that looks like a mobile number - 07777 123 456 usually works
• If they are asking for an address and you don't think it is required, say you live on the moon. Don't use other people's addresses, that's not fair on them.
• Find out the Company's head office address and put your address as "Care Of" their address
• If they are asking for a telephone number find their phone number and use that.
• if you do not wish to use false or fictional information then be honest, enter the text "Not Required" in the fields you do not wish to enter the data for. Where the field is a drop down selection (for example a postcode) complete the last line of the address with "the following postcode is incorrect but you made me put something" then select any postcode

Things to keep in mind!!

Ensure you give all the information you need ...

• If you are buying something that needs delivering, the company will need an address to deliver to.
• If the company are going to text you with important information (like a delivery date) they will need your phone number.
• Many companies will text you a confirmation code so you need to give a number you can receive the code on. There are one time phone numbers you can use for; this try searching for "One Time Phone Number" or "Temporary mobile numbers"
• If this is an official form and you are declaring you have not made any false statements you should not be using fictional information.

So Remember ...

The power is in your hands, they can only collect the data YOU are prepared to give them. We need to stop companies from uniformly requesting all this data. Companies don't reform because it's right - they reform when the friction exceeds the gain, so let's all "#IncreaseTheFriction" and make it not worth their while trying to harvest all this information. Maybe then they will stop forcing us to fill in fields on the form because entering false information will contaminate their database, the more false information, the more contaminated, hopefully persuading them to limit their requests to that data needed for the purpose in question. Just as the GDPR demands!.