A controller’s web form, by default, displays and invites completion of thirty optional special-category health fields that are unnecessary for the stated signup purpose. Which accountability principle is most directly engaged?
Select an answer to reveal the explanation.
Short Explanation
Leaving thirty health checkboxes wide open on a simple signup is like putting every medicine cabinet drawer on the welcome desk. Privacy by design and by default says start locked-down and collect only what the purpose needs. Portability and transfers are different chapters.
Full Explanation
Article 25 requires controllers to implement data protection by design and by default, ensuring that by default only personal data necessary for each specific purpose are processed. Unnecessary special-category fields enabled by default conflict with that duty. Storage limitation and transfer rules may arise elsewhere but do not capture the default-overcollection design failure. Portability is a data-subject right, not the primary fix for excessive defaults.