A project team proposes collecting every available customer data field in case it may be useful later. Which privacy principle is most directly at…

The scenario directly violates the "Limiting Collection" principle of the Personal Information Protection and Electronic Documents Act (PIPEDA). Principle 4.4 dictates that organizations must limit the collection of personal information to only that which is strictly necessary for the specific, identified purposes. Collecting extraneous data fields "just in case" they might be useful in the future is explicitly prohibited under this principle, as it leads to over-collection, unnecessary privacy risks, and violates the requirement for data minimization.

A. The Accuracy principle ensures data is correct and up-to-date, but it does not govern the volume or scope of data initially collected.

B. Individual access relates to a person's right to view and amend their stored data, not the organization's initial collection practices.

C. Openness requires organizations to make their privacy policies readily available to the public, which does not address the over-collection of data.

1. Office of the Privacy Commissioner of Canada. (2019). PIPEDA fair information principles. Principle 4: Limiting Collection (Section 4.4.1).

2. Office of the Privacy Commissioner of Canada. (2018). Guidelines for obtaining meaningful consent. Section: "Collection must be limited to what is necessary".