A city legal notice limits unnecessary personal data in portal telemetry. What privacy practice should the web analyzer follow?
Select an answer to reveal the explanation.
Short Explanation
Clickstreams do not need a resident's life story to tell you which button is confusing. Skip unnecessary PII, stick to the notice you already posted, and still get solid UX data. Less sensitive junk also means fewer headaches when someone asks what you collected.
Full Explanation
Civic web analyzers should avoid storing unnecessary PII in the clickstream and must honor published collection notices when legal limits restrict personal data in portal telemetry. Minimization and transparency protect residents while still allowing aggregate UX measurement. Privacy practice is inseparable from Cap. 10 analyzer design for municipalities that serve the public.
Capturing full Social Security numbers in every page-view event for speculative future joins violates minimization and creates severe breach impact. Ignoring privacy notices because analytics beacons supposedly are exempt from municipal policy is not a defensible stance. Mirroring complete form field values—including passwords—into the analytics lake is a critical security and privacy failure.
Exam caveat: some operational metrics need careful pseudonymous identifiers; use opaque tokens and separate identity resolution under stricter controls rather than stuffing raw PII into beacons. Operational check: sample raw beacon payloads for PII patterns, remove or hash unnecessary fields, and confirm the public privacy notice matches what is actually collected. Document the verified decision in the municipal architecture runbook so future on-call and audit staff inherit the same standard.